By default, Combidesk connects to Stripe using a full Secret key. Prefer to work with a restricted key? Below we explain the pros and cons and which permissions you need.
Standard Secret key vs. Restricted key
Advantages of a standard Secret key
Combidesk has been fully tested with this key — you can be confident everything works.
When we expand the integration with new functionality, it works immediately without needing to update the key.
Disadvantages of a standard Secret key
A standard Secret key grants full access to your Stripe environment. Even though Combidesk only reads data, technically speaking much more is possible with this key. For companies with security certifications (such as ISO 27001 or SOC 2), this can be a compliance issue.
Advantages of a Restricted key
You grant only the permissions that are actually needed — nothing more, nothing less. This is more manageable from a security and compliance perspective.
Disadvantages of a Restricted key
Combidesk has not been tested with this setup, so we cannot provide any guarantees.
When the integration is expanded, additional permissions may be required that you will need to manually add to the restricted key.
Which permissions does Combidesk need?
Combidesk only retrieves data from Stripe — nothing is written back. For a working integration (with all options enabled) you need the following read-only permissions:
Resource | Permission |
Balance | Read |
Balance transactions | Read |
Charges | Read |
Customers | Read |
Invoices | Read |
Payment Intents | Read |
Payouts | Read |
Products | Read |
Prices | Read |
Refunds | Read |
Credit notes | Read |
How to create a restricted key
Log in to your Stripe Dashboard
Go to Developers → API Keys
Click Create restricted key
Choose "Build your own integration"
Set the permissions as described above
Copy the key and enter it in your Combidesk integration