Integration · Payments
Stripe automation where no agent moves money without approval
We build billing workflows on Stripe events: a paid invoice updates your CRM, a failed payment starts a reminder sequence, a dispute opens a case. Anything that moves money, such as a refund or a credit, is drafted by the system and released by a person.
Stripe
Payments
Access
Authentication and least-privilege scopes
A restricted API key with only the permissions the workflow needs, plus a signing secret per webhook endpoint
- invoices: read
- customers: read
- refunds: write, approval-gated
- webhook: signing secret
Restricted keys can be tagged for agent use, so Stripe’s own approval rules require a reviewer for sensitive actions such as refunds. Our code gates those actions as well.
Objects
What we read and what we write
Event (webhook)
Read: YesWrite: No
invoice.paid, payment_intent.payment_failed, charge.refunded and the others you subscribe to.
Customer
Read: YesWrite: No
Matched to your CRM record by a stored id, never by name.
Invoice + subscription
Read: YesWrite: No
Status and amounts that drive reminders, access and reporting.
Refund
Read: YesWrite: Yes
Created only after approval, with an idempotency key.
Idempotency key
Read: NoWrite: Yes
One per intended action, so a retry cannot refund twice.
Approval record (your system)
Read: YesWrite: Yes
Who approved what and when, and the Stripe object it produced.
Data flow
System of record and write-back
Stripe is the system of record for payments; your CRM and accounting tools mirror what they need. The workflow service sits between them and keeps the approval log.
- Stripe sends a signed event; the service verifies it and returns 2xx at once.
- The event id is checked against processed events, so a redelivery is ignored.
- Read-only work runs straight away: CRM updates, reminders and internal alerts.
- Money-moving actions become drafts. After a person approves, the call goes to Stripe with an idempotency key.
- Stripe events
- Support request
- CRM
- Approval queue
- Accounting tool
Worked example
Stripe in a build
- 00:00PLANHelpdeskHelpdesk › Ticket: customer says they were charged twice for one order.
- 00:02TOOLAgentAgent › Read-only lookup: two successful payments match the same order id.
- 00:03APPROVALAgentAgent › Draft refund of the duplicate payment, evidence attached. Waiting for a person.
- 00:41APPROVEDFinance leadFinance lead › Approved in the queue; note saved to the approval log.
- 00:41TOOLServiceService › Refund created with an idempotency key tied to the approval id.
- 00:42OKWebhookWebhook › charge.refunded received, signature verified, event id recorded.
- 00:43DONEServiceService › Ticket answered; CRM and ledger updated.
Sample workflows
What teams build with Stripe
Pattern 01
Failed-payment recovery
payment_intent.payment_failed starts a reminder sequence, stops it when the payment succeeds and alerts the account owner before access changes.
Pattern 02
Paid invoice to CRM and accounting
invoice.paid marks the deal won, posts the payment to your accounting tool and stores the Stripe ids on both sides for reconciliation.
Pattern 03
Dispute case preparation
A new dispute opens a case with the order, delivery proof and messages gathered for a person to review and submit.
Failure handling
What breaks, and what the build does about it
Events arrive out of order
Handlers never assume order. Each reads the current object from the API before acting, so a late event cannot undo a newer state.
The same event is delivered twice
Processed event ids are stored, and repeats are acknowledged without doing the work again.
A refund call times out
It is retried with the same idempotency key, so Stripe returns the first result instead of refunding again.
Fit · Stripe
When it is the wrong choice
- You want an agent to issue refunds, credits or payouts with no human check. We will not build that.
- A notification on each payment is all you need. Stripe’s own emails or a single Zap may be enough.
- Your billing rules change weekly and live in spreadsheets. Settle the rules first, or automation locks in the confusion.
Where it is used
Related use cases, services and guides
Limits
Limits and common errors
Verify each event with the Stripe-Signature header, the endpoint’s signing secret and the unmodified raw body, and return 2xx before any complex logic.
Source: Receive Stripe events in your webhook endpoint (opens in a new tab) · Stripe Docs · accessed
In live mode Stripe retries delivery for up to three days with exponential backoff. Delivery order is not guaranteed and duplicates can occur, so track event ids.
Source: Receive Stripe events in your webhook endpoint (opens in a new tab) · Stripe Docs · accessed
All POST requests accept an Idempotency-Key of up to 255 characters; keys can be pruned once at least 24 hours old, and reuse with different parameters is rejected.
Source: Idempotent requests (opens in a new tab) · Stripe API Reference · accessed
Restricted API keys carry only the permissions you grant; keys tagged for agent use are subject to approval rules covering payouts, refunds and account changes.
Source: API keys (opens in a new tab) · Stripe Docs · accessed
The global rate limit is 100 requests per second in live mode and 25 in a sandbox; limited requests return 429 with a Stripe-Rate-Limited-Reason header.
Source: Rate limits (opens in a new tab) · Stripe Docs · accessed
Security
Security notes
- Webhook signatures are verified on the raw body, and stale timestamps are rejected to stop replays.
- The workflow runs on a restricted key; no unrestricted secret key exists in the codebase.
- Every money-moving action records who approved it, when, and the Stripe id it produced.
- Card data never touches our code: payments are collected on Stripe-hosted pages or elements.
FAQ
Frequently asked questions
Can an AI agent issue Stripe refunds on its own?
Not in anything we build. The agent gathers evidence and drafts the refund, a named person approves it in a queue, and only then does the service call Stripe. Stripe’s approval rules for agent-tagged keys add a second gate on Stripe’s side.
How do you check that a Stripe webhook is genuine?
Each request is verified against the Stripe-Signature header with the endpoint’s signing secret on the raw body, and stale timestamps are rejected. Unverified requests are dropped before any work happens.
What happens if our server is down when Stripe sends an event?
In live mode Stripe keeps retrying for up to three days, so nothing is lost while the service recovers. Retries can arrive late and out of order, so handlers check the event id and the object’s current state first.
Do you need our Stripe secret key?
No. We ask for a restricted key with only the permissions the workflow uses, created by you in your account, and we build in a sandbox until the work is ready for live mode.
Can you connect Stripe to our CRM and accounting tool?
Yes, through their APIs or an automation tool. Stripe ids are stored on both sides, so every payment, refund and invoice can be traced and reconciled in either direction.
Next step
Have a workflow in mind? Let’s scope it together.
Book a free 30-minute strategy call. Bring one process you want to automate and we will talk through scope, integrations and a sensible first step.
Free 30-minute call · no commitment