• Resolved user3292

    (@user3292)


    Hi,

    I’m connecting Forminator to my Stripe account (/wp-admin/admin.php?page=forminator-settings&section=payments). I would like to give Forminator a restricted API key to limit access to my Stripe account (especially since WordPress is known for security issues). Could you please tell me which API resources are consumed by Forminator?

    Thanks,
    Jeff

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support Laura – WPMU DEV Support

    (@wpmudev-support8)

    Hi @user3292

    I hope you’re well today!

    I must say that I’m not sure what exact permissions it would need so I have asked our Formiantor Team for advice. I’m awaiting their response and I (or one of my colleagues) will update you here with more information soon.

    Best regards,
    Adam

    Plugin Support Laura – WPMU DEV Support

    (@wpmudev-support8)

    Hi @user3292

    I got an update on this:

    The very essentials are Customer, Charge, PaymentIntent and Invoices and they need to have Read and Write access allowed.

    If you also handle subscription-based payemnts, you also need set Subscriptions with Read/Write access.

    Theoretically, the rest can be set to None (disallowed) but in practice you may need to do some testing on it (e.g. on test site with Stripe in test mode) to make sure, as some slight tweaks to above permissions may turn out to be necessary (especially that Stripe is sometimes changing their policies).

    Kind regards,
    Adam

    Thread Starter user3292

    (@user3292)

    Thanks a lot for your quick response and looking into this!

    I just tried this out, but when I go to input the test/secret restricted keys, their not accepted.

    I’m at /wp-admin/admin.php?page=forminator-settings&section=payments and when I submit my keys, it says first You've entered an invalid test secret key and if I fill that in with my full secret test key then it says a couple fields down You've entered an invalid live secret key.

    Any idea if there’s another API permission that that form uses to validate?

    Thread Starter user3292

    (@user3292)

    Update:

    After digging around in Forminator’s source code, I got it to work with the following permissions. Maybe these permissions could be slimmed down a little.

    • Charges, WRITE
    • Customers, WRITE
    • Invoices, WRITE
    • All Connect resources, WRITE (maybe read would be enough)

    Peace,
    Jeff

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Stripe API Restricted keys’ is closed to new replies.