[RFC] Stripe

[fredericbarthelet]

The aims of this RFC is to discuss the API, implementation and features offered through the creation of a new Stripe provider and its set of Constructs.

Stripe aims at integrating payment solution like a breeze. Developing a Stripe provider aims at automating and easily reproduce Stripe account provisioning and modification

Current conditions

Stripe develops and maintains a CLI tool. This CLI tools allows simple operation from your terminal using profiles. Those profiles' configuration is stored in ~/.config/stripe/config.toml. Each profile contains 2 pairs of public/secret keys (one for test and one for live), as well as a Stripe account ID - acct_xxxxxxxxxxx - and a device name.

[default]
  account_id = "acct_xxxxxxxxxxx"
  device_name = "my-macbook"
  live_mode_api_key = "rk_live_xxxxxxxxxxx"
  live_mode_publishable_key = "pk_live_xxxxxxxxxxx"
  test_mode_api_key = "rk_test_xxxxxxxxxxxxxxxxxxxxxx"
  test_mode_publishable_key = "pk_test_xxxxxxxxxxx"

[profileA]
  account_id = "acct_xxxxxxxxxxx"
  device_name = "my-macbook"
  live_mode_api_key = "rk_live_xxxxxxxxxxx"
  live_mode_publishable_key = "pk_live_xxxxxxxxxxx"
  test_mode_api_key = "rk_test_xxxxxxxxxxxxxxxxxxxxxx"
  test_mode_publishable_key = "pk_test_xxxxxxxxxxx"

When provisioning a profile on your machine using stripe login interactive command, a user manual confirmation is requested and a limited key is created with a validity period of 90 days.

[mnapoli]

The Stripe docs mention the possibility to use environment variables for API keys: https://stripe.com/docs/cli/api_keys

You can set two environment variables, which take precedence over all other values:

• STRIPE_API_KEY: the API key to use for the CLI.

I'm guessing this is useful for CI environments. It might be worth supporting too here?

[fredericbarthelet]

Agreed :) If we make a parallel with AWS way of resolving configuration:

• Profile sourcing :
  • In AWS, you can use AWS_PROFILE to select a dedicated profile from ~/.aws/credentials or ~/.aws/config
  • In Stripe, you can use project_name as on option to command (like --profile for AWS) but I'm not sure you can source this from env. This is used to source dedicated profile from AWS_SECRET_ACCESS_KEY
• Crendentials sourcing :
  • In AWS, you can use AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY to use a dedicated IAM user
  • In Stripe, you can use STRIPE_API_KEY to use a dedicated Stripe account

However, there is no other way that through profile to specify stripe account id AFAIK.