Connect Stripe

Create a restricted Stripe key with read access for Control.

Use a restricted API key instead of a full-access standard secret key.

Create a restricted key

1. Sign in to the Stripe Dashboard.
2. Switch to the intended sandbox/test or live mode.
3. Go to Developers → API keys.
4. Under Restricted keys, choose Create restricted key.
5. Name the key Control.
6. Grant Read access to the resources listed below. Leave every other permission at None.
7. Create the key, complete Stripe’s verification step, and copy the value.

Connect in Control

1. Open the Stripe data source in .
2. Paste the restricted key into Secret Key.
3. Save and verify the credentials.

Test and live modes contain different data and use different keys. Connect the mode you intend to report on.

Restricted-key permissions

The Dashboard sorts permissions into categories such as Core and Billing, and its labels do not always match Stripe’s API resource names. Everything Control reads sits in those two categories, so the quickest correct setup is to select Read on the Core and Billing category headers and leave every other category at None.

To grant the narrowest possible access instead, set Read on these individual permissions:

Stripe Dashboard permission	Category	Data read by Control
Customers	Core	Customers
Balance transaction sources	Core	Balance transactions
Charges	Core	Charges and refunds
PaymentIntents	Core	Payment intents
Payment Methods	Core	Payment methods
Products	Core	Products
Prices	Billing	Prices
Coupons	Billing	Coupons
Promotion Codes	Billing	Promotion codes
Subscriptions	Billing	Subscriptions and subscription items
Invoices	Billing	Invoices and invoice lines
Credit notes	Billing	Credit notes
Tax Rates	Billing	Tax rates

Control also reads refunds, invoice items, legacy plans, and tax codes. Stripe has no separate rows for those, and it renames and regroups the rows it does have from time to time. If a name in the table is missing from your Dashboard, grant Read on the whole Core and Billing categories instead of hunting for an exact match.

Control only issues read requests against these resources. It never creates, updates, refunds, charges, or otherwise changes Stripe data, and it does not read Events or register webhooks in your account. A full-access standard secret key is not required.

If a sync or credential check fails with a permissions error, the Stripe error message names the permission that was missing. Add that one in Edit key, then verify the credentials in Control again.

Data imported

• Customers
• Products, prices, plans, coupons, promotion codes, and tax configuration
• Subscriptions and subscription items
• Invoices, invoice items, and invoice line items
• Charges, payment intents, payment methods, and balance transactions
• Credit notes and refunds

If the key is lost or exposed, delete or rotate it in Stripe and update Control.

Provider documentation

• Stripe API keys
• Stripe restricted-key security guidance