Stripe support

2. Before you create a key

• Confirm you are a current administrator of the intended Seedling workspace and are authorized to create restricted keys for the one exact Stripe account.
• Record the Stripe account ID and choose its matching live, test, or sandbox environment. Seedling does not traverse Connect child accounts.
• Review the 365-day transactional history, full current catalog and retained subscription coverage, excluded sensitive fields, and closed-by-default human access policy in the integration guide.
• Do not send a Stripe key, billing record, customer identity, provider response, or screenshot containing secrets through email or an ordinary support ticket.

3. Create the restricted key

1. In the exact Stripe account and environment, create a new restricted API key. Do not reuse a broad secret key or a key for another account or mode.
2. Set Account, Customers, Products, Prices, Subscriptions, Invoices, PaymentIntents, Charges/refunds, Disputes, Credit notes, Payouts, Balance, and Events to Read.
3. Leave every unrelated resource at None. Do not enable write access, payment instruments, Files, Connect resources, or balance_transaction_source_read.
4. Copy the new restricted key directly into Seedling's encrypted form. Live connections require rk_live_; test connections require rk_test_; a sandbox key must use Stripe's documented sandbox restricted-key prefix for that selected environment.
5. Keep the key in your organization's approved secret-handling process until Seedling verifies the connection; never paste it into chat or support.

4. Connect Stripe

1. In an approved Seedling workspace, open Connections and choose Stripe.
2. Choose the matching live, test, or sandbox environment and enter the exact Stripe account ID.
3. Enter the restricted rk_ key and acknowledge the displayed restricted billing-data use.
4. Seedling verifies the exact account and mode and performs one bounded probe for every required read family. An authorized empty page passes; any missing required capability rejects the connection.
5. After the initial synchronization completes, a current workspace owner or source steward must assign the applicable Stripe data-type scopes to each active member who should read the data. Installing the connector does not grant raw access to anyone.

5. Credential and capability problems

Key type rejected

Create an environment-matching restricted rk_ key. Seedling rejects sk_, pk_, whsec_, OAuth, and unknown secret formats before making a provider request.

Wrong account or mode

Confirm the supplied acct_ identity is the account that created the key and that live, test, or sandbox matches. Seedling never falls back to an account name, email, or Connect header.

Missing capability

Restore Read for the named required resource and retry. Do not substitute a broad secret key or add balance_transaction_source_read; Balance read failure removes that optional phase-1 detail rather than broadening access.

Reauthorization required

A persistent unauthorized response means the restricted key was deleted, rotated, or no longer works. A current workspace administrator must replace it on the exact connection.

No member can see data

This is expected before access is assigned. A current workspace owner or source steward must grant the relevant exact-connection data-type scopes; administrator, steward, installer, workspace-member, and Stripe-role status do not create a raw-data bypass.

6. Missing or delayed data

1. Confirm the record belongs to the verified Stripe account, selected environment, supported phase-1 resource families, and configured 365-day history or retained relationship coverage.
2. Confirm the connection remains healthy and every required capability still passes. A forbidden resource fences that capability; a partial or failed run does not delete earlier data or advance its watermark.
3. For member-visible data, confirm the member is active and has the matching Customers, Product catalog, Subscriptions, Invoices, Payments, Adjustments, Disputes, or Payouts scope on this exact connection.
4. Allow the six-hour event-polling cadence and weekly deep reconciliation to repair ordinary delivery gaps. A gap of 30 days or more retains a visible history-gap warning even after current state is repaired.
5. If the issue remains, contact support@tryseedling.ai with the Seedling workspace, environment, safe timestamps, the masked Stripe account suffix, and Stripe Request-Id when available. Do not include keys, customer data, object contents, URLs, or provider response bodies.

7. Rotate or replace the restricted key

Stripe restricted keys do not expire on a timer. Rotate them under your organization's security policy or after suspected exposure, and never transfer either key through support.

1. Create a new restricted key in the same Stripe account and environment with the same or narrower released Read permissions.
2. As a current Seedling workspace administrator, replace the key on the exact Stripe connection. Seedling verifies account identity, environment, and every required capability before atomically activating it.
3. After Seedling confirms the replacement, delete the old restricted key in Stripe.
4. If the replacement changes account, environment, or released capability, disconnect and complete the reviewed installation path instead of silently changing the connection boundary.