> ## Documentation Index
> Fetch the complete documentation index at: https://control-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Stripe

> Create a restricted Stripe key with read access for Control.

export const ControlAppLink = ({path, breadcrumb, children}) => {
  const link = <a href={`https://app.control.dev${path}`} target="_blank" rel="noopener noreferrer" aria-label={breadcrumb ? `Open ${breadcrumb} in Control` : undefined}>
      {children}
    </a>;
  return breadcrumb ? <Tooltip tip={breadcrumb}>{link}</Tooltip> : link;
};

Use a restricted API key instead of a full-access standard secret key.

## Create a restricted key

1. Sign in to the [Stripe Dashboard](https://dashboard.stripe.com).
2. Switch to the intended sandbox/test or live mode.
3. Go to **Developers → API keys**.
4. Under Restricted keys, choose **Create restricted key**.
5. Name the key `Control`.
6. Grant **Read** access to the resources listed below. Leave every other permission at **None**.
7. Create the key, complete Stripe's verification step, and copy the value.

## Connect in Control

1. Open the Stripe data source in <ControlAppLink path="/entities-data-sources/overview"><strong>Entities & sources</strong></ControlAppLink>.
2. Paste the restricted key into **Secret Key**.
3. Save and verify the credentials.

<Warning>
  Test and live modes contain different data and use different keys. Connect the mode you intend to report on.
</Warning>

## Restricted-key permissions

The Dashboard sorts permissions into categories such as **Core** and **Billing**, and its labels do not always match
Stripe's API resource names. Everything Control reads sits in those two categories, so the quickest correct setup is to
select **Read** on the **Core** and **Billing** category headers and leave every other category at **None**.

To grant the narrowest possible access instead, set **Read** on these individual permissions:

| Stripe Dashboard permission | Category | Data read by Control                 |
| --------------------------- | -------- | ------------------------------------ |
| Customers                   | Core     | Customers                            |
| Balance transaction sources | Core     | Balance transactions                 |
| Charges                     | Core     | Charges and refunds                  |
| PaymentIntents              | Core     | Payment intents                      |
| Payment Methods             | Core     | Payment methods                      |
| Products                    | Core     | Products                             |
| Prices                      | Billing  | Prices                               |
| Coupons                     | Billing  | Coupons                              |
| Promotion Codes             | Billing  | Promotion codes                      |
| Subscriptions               | Billing  | Subscriptions and subscription items |
| Invoices                    | Billing  | Invoices and invoice lines           |
| Credit notes                | Billing  | Credit notes                         |
| Tax Rates                   | Billing  | Tax rates                            |

Control also reads refunds, invoice items, legacy plans, and tax codes. Stripe has no separate rows for those, and it
renames and regroups the rows it does have from time to time. If a name in the table is missing from your Dashboard,
grant **Read** on the whole **Core** and **Billing** categories instead of hunting for an exact match.

Control only issues read requests against these resources. It never creates, updates, refunds, charges, or otherwise
changes Stripe data, and it does not read Events or register webhooks in your account. A full-access standard secret key
is not required.

<Tip>
  If a sync or credential check fails with a permissions error, the Stripe error message names the permission that was
  missing. Add that one in **Edit key**, then verify the credentials in Control again.
</Tip>

## Data imported

* Customers
* Products, prices, plans, coupons, promotion codes, and tax configuration
* Subscriptions and subscription items
* Invoices, invoice items, and invoice line items
* Charges, payment intents, payment methods, and balance transactions
* Credit notes and refunds

If the key is lost or exposed, delete or rotate it in Stripe and update Control.

## Provider documentation

* [Stripe API keys](https://docs.stripe.com/keys)
* [Stripe restricted-key security guidance](https://docs.stripe.com/keys-best-practices)