Make your Stripe restricted key
Card Payments + Buy Now needs one key from Stripe for each mode, test and live. Stripe asks payment extensions to use a restricted key: a key that can only do what the extension needs. If it ever leaked, it could not be used to read your whole Stripe account or send your payouts anywhere else.
Make the key
- In OpenCart, open Extensions, then Payments, then Card Payments + Buy Now, and choose the Test or Live tab.
- Press Create the key in Stripe. Stripe opens its "Create restricted key" page with the permissions below already ticked. Check them, then press Create key.
- Copy the key. It starts
rk_live_(orrk_test_in test mode). Paste it into the Restricted key box in OpenCart and press Save. - Press Check connection. It should say the key has every permission the extension needs. If it names one that is missing, edit the key in Stripe, set that permission as in the table, and check again.
Stripe shows a live key only once, when it is made. If you lose it, make a new one the same way.
The permissions it needs
If you make the key yourself in the Stripe Dashboard (Developers, API keys, Create restricted key), give it these and leave everything else as None.
| Stripe permission | Access | What it is for |
|---|---|---|
| Payment Intents | Write access | take payments |
| Setup Intents | Write access | save a card for next time |
| Customers and Customer Sessions | Write access | show a customer their saved cards |
| Payment Methods | Write access | list and remove saved cards |
| Charges and Refunds | Write access | refund from the order page |
| Checkout Sessions | Write access | the "pay on Stripe's page" option |
| Payment Method Configurations | Write access | turn card, Apple Pay, Google Pay and the rest on or off from your settings |
| Payment Method Domains | Write access | register your shop's address for Apple Pay and Google Pay |
| Webhook Endpoints | Write access | the "Set up webhook" button |
| Disputes and Events | Read access | show disputes on the order |
Already using your full secret key?
Shops set up before restricted keys came in may have the full secret key (sk_live_) saved. It keeps working, and the settings page shows a notice until you swap it. Make a restricted key as above, paste it in and save. Then delete or roll the old secret key in Stripe, if nothing else on your side uses it.
Where the key goes
The key stays in your shop and is only ever sent to Stripe. The extension has no licence server and never sends us your key, your sales or your customers' details.