Stripe

Overview

Connect your users to Stripe via Stripe Connect for payment processing, account management, and financial data access.

Property	Value
Provider ID	stripe
Category	Payments
PKCE	Not supported
Token refresh	Not supported (tokens do not expire; Stripe’s refresh token is deprecated and unused)
Redirect URI	Shown in Developer Portal

Step 1: Create a Stripe Connect OAuth App

Go to Stripe Connect OAuth Settings

Navigate to dashboard.stripe.com/settings/connect/onboarding-options/oauth and sign in.

Enable OAuth

Enable Onboard accounts with OAuth.

Configure the redirect URI

Add the Alter callback URL from the Developer Portal to the Redirect URIs field.

Get credentials

Copy the Client ID from the Connect settings page. Your Secret Key is your Client Secret: from the Developers menu open Workbench and click Manage on the API keys widget, or go directly to dashboard.stripe.com/apikeys.

Warning

Never share your Secret Key publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Stripe provider

Go to OAuth Providers > Add Provider > Stripe.

Enter credentials

• Client ID: Paste your Stripe Connect Client ID
• Client Secret: Paste your Stripe Secret Key

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
read_only	Read-only access to Stripe account data
read_write	Full read and write access to Stripe account data

Notes

• Stripe Connect access tokens do not expire. Stripe still documents a deprecated refresh-token grant, but recommends acting via the Stripe-Account header instead; Alter does not run a refresh flow.
• Stripe Connect is for connecting to other Stripe accounts (not individual user accounts).
• Stripe recommends Connect Onboarding instead of OAuth for new integrations.
• Connecting a live Standard account walks the account holder through Stripe’s full KYC (legal name, SSN/tax id). For development, use test-mode values — the test Client ID (ca_... with “Viewing test data” on) and the test Secret Key (sk_test_...) — and Stripe offers a “skip this account form” path on the test onboarding screen.
• See the Stripe Connect OAuth reference for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
PostCharges	payment	POST	/v1/charges
GetCharges	read	GET	/v1/charges
GetChargesCharge	read	GET	/v1/charges/{charge}
PostChargesCharge	write	POST	/v1/charges/{charge}
PostChargesChargeCapture	payment	POST	/v1/charges/{charge}/capture
PostRefunds	payment	POST	/v1/refunds
GetRefunds	read	GET	/v1/refunds
PostPaymentIntents	payment, write	POST	/v1/payment_intents
GetPaymentIntents	read	GET	/v1/payment_intents
GetPaymentIntentsIntent	read	GET	/v1/payment_intents/{intent}
PostPaymentIntentsIntentConfirm	payment	POST	/v1/payment_intents/{intent}/confirm
PostPaymentIntentsIntentCapture	payment	POST	/v1/payment_intents/{intent}/capture
PostPaymentIntentsIntentCancel	write	POST	/v1/payment_intents/{intent}/cancel
PostPayouts	payment	POST	/v1/payouts
GetPayouts	read	GET	/v1/payouts
PostPayoutsPayoutCancel	payment	POST	/v1/payouts/{payout}/cancel
PostTransfers	payment	POST	/v1/transfers
GetTransfers	read	GET	/v1/transfers
GetBalance	read	GET	/v1/balance
PostCustomers	write	POST	/v1/customers
GetCustomers	read	GET	/v1/customers
GetCustomersCustomer	read	GET	/v1/customers/{customer}
PostCustomersCustomer	write	POST	/v1/customers/{customer}
DeleteCustomersCustomer	delete	DELETE	/v1/customers/{customer}
PostInvoices	write	POST	/v1/invoices
GetInvoices	read	GET	/v1/invoices
PostInvoicesInvoiceSend	send	POST	/v1/invoices/{invoice}/send
PostInvoicesInvoicePay	payment	POST	/v1/invoices/{invoice}/pay
PostSubscriptions	payment, write	POST	/v1/subscriptions
GetSubscriptions	read	GET	/v1/subscriptions
GetSubscriptionsSubscriptionExposedId	read	GET	/v1/subscriptions/{subscription_exposed_id}
DeleteSubscriptionsSubscriptionExposedId	delete, payment	DELETE	/v1/subscriptions/{subscription_exposed_id}