Stripe connector setup

Stripe does not fit the "bring your own OAuth app" shape most other pages here describe. There is no client id, no client secret and no docs/connectors/README.md botseon oauth-app set step for it. Instead, a member creates a restricted API key directly in the Stripe Dashboard and pastes it into the plugin sheet's own Connect field — the same pasted-key path sentry.md describes.

1. Create the restricted key in Stripe

1. Sign in to the Stripe Dashboard as the account Owner or an Administrator — only those roles (plus IAM Administrator and Super Administrator) can create or reveal restricted keys.
2. Check the sandbox/live mode toggle before creating the key. Sandbox and live mode have entirely separate keys and data — a key copied from the wrong mode silently returns empty test data instead of the business's real transactions. Live keys need an activated (verified) account; until then the Dashboard only offers sandbox keys.
3. Open Developers -> API keys (or Workbench -> API keys) and click Create restricted key, starting from zero permissions.
4. For the Balance resource, set Read. Leave every other resource None — this connector only ever calls GET /v1/balance, and a restricted key with None everywhere else is the setup Stripe itself recommends.
5. Complete the two-factor verification prompt, then click the key value once to copy it — Stripe will not show it again. Paste it straight into the plugin sheet's Connect field.

If a call later returns a permission error, the fix is to edit the key's permissions in Stripe and add the missing resource, then use the plugin sheet's own recheck control — the key does not escalate on its own.

2. The declared scope checklist

The plugin sheet shows one box to tick before Connect unlocks: Balance: Read (balance:read, CONNECTOR_SCOPE_SETS.stripe.read in packages/core/src/connector-catalog.ts). This is a declaration, not a probe — ticking it records what you set up in step 1, and nothing in Botseon asks Stripe to confirm it ahead of the first real call. Leaving it unticked keeps Connect disabled, since the connector's one tool needs it.

3. What the tool does

This connector is read-only. There is no write tool, and the restricted key should carry no write permission either.

4. Pitfalls

• Sandbox vs. live is a Dashboard toggle, not a key property you can infer later — confirm it shows live mode before creating the key you intend to paste into a production account.
• Dashboard role: a teammate without Owner/Administrator/IAM Administrator/Super Administrator cannot see the API keys page at all.
• The key is shown once. If you lose it before pasting it in, revoke it in Stripe and create a new one — there is no way to have Stripe display it again.