Connect Stripe with a key that can only read

01Connect Stripe

1. 1

   Create a restricted key in Stripe

   Tally only reads your payments; it never needs to move money. A restricted key can do only what you allow, and you can revoke it in Stripe at any time. In Stripe, open Developers, API keys, choose Create restricted key, and set these:

   Permission	Access	Why
   PaymentIntents	Read	Every payment: its amount, currency, customer and metadata.
   Invoices	Read	Whether a payment is a subscription's first, a renewal or a plan change, and the tax in it.
   Checkout Sessions	Read	The visitor id you pass in metadata or client_reference_id, and which Payment Link sold it.
   Customers	Read	The customer's metadata, and their email to match tally('identify'): hashed at once, never stored.
   Charges	Read	Refunds.
   Disputes	Read	Chargebacks, and funds reinstated after a won dispute.
   Webhook Endpoints	Write	Tally creates its own endpoint on your account, so payments arrive within seconds.

   Leave everything else at None.

2. 2

   Paste the restricted key

   On your site's Integrations page (or the Payments step when you add a site), open Stripe and fill in:

   • Restricted key: It starts with rk_live_ or rk_test_. Tally stores it encrypted and never shows it again.

   Then press Connect Stripe.

3. 3

   Tally checks it and imports the past year

   It names any permission the key is missing, adds its own webhook to your account so new payments arrive as they happen, and imports the past 365 days.

02Keys and accounts

• Only a restricted key is taken: a secret key (sk_…) is refused before it's used.
• A key made in test mode (rk_test_…) sees test payments, which is the way to try it first.
• Each Stripe account is a connection of its own: connect each one you sell through.
• Revoke the key in Stripe at any time, or disconnect it on the Integrations page: the payments already imported stay, with their receipts.

03Tie new payments to their visits

The import brings the past year. For the payments that come next, your checkout carries the visitor's id. Which page you need depends on how you take payment:

• Stripe CheckoutYour server creates Checkout Sessions.
• Stripe Payment LinksBuy buttons that go to buy.stripe.com.
• Other Stripe paymentsThe Payment Element, subscriptions from the API, invoices.

04Check it worked