BusyBot

Reference · Credentials

Stripe API credentials

Used by 2 BusyBot nodes.

Type stripeApi 2 fields

The Stripe credential holds a secret key (`sk_test_…` or `sk_live_…`) from your Stripe dashboard, plus an optional webhook signing secret (`whsec_…`) that the Stripe trigger uses to verify incoming events. The key's prefix decides which mode's data you see.

Fields

FieldTypeRequiredNotes
Secret Key
secretKey		 password Yes Your Stripe secret key (sk_test_... or sk_live_...)
Signing Secret
signatureSecret		 password No Webhook signing secret (whsec_...) used to verify the authenticity of incoming webhook requests from Stripe. Required when using the Stripe trigger. Auto-populated when the trigger creates its own webhook endpoint.

Getting your credentials

  1. Sign in to the Stripe dashboard.
  2. Open Developers → API keys.
  3. Note the test/live toggle. A key beginning sk_test_ only ever sees test data; sk_live_ sees real money. Choose deliberately.
  4. Reveal and copy the secret key, or better, create a restricted key granting only the resources the workflow uses.
  5. Paste it into the credential’s Secret Key field.
  6. For the Stripe trigger, the Signature Secret (whsec_…) is populated automatically when the trigger creates its own webhook endpoint. If you configured the endpoint manually in Stripe, copy its signing secret from the webhook’s details page.

Permissions and scopes

Prefer a restricted key over the account secret key. Restricted keys are scoped per resource with read or write access, so a workflow that only reads charges cannot issue refunds. The account secret key can do everything, which is rarely what an automation needs.

Never use a live key while building. Test mode exercises the same API with no financial consequence.

Troubleshooting

  • Objects exist in the dashboard but the workflow finds nothing — you are using a test key against live data or the reverse. Test and live are separate universes.
  • Permission errors on a restricted key — that resource or write permission was not granted when the key was created.
  • Webhook signature verification fails — the signing secret belongs to a different endpoint than the one sending events. Each endpoint has its own.
  • 401 Unauthorized — the key was rolled or revoked in the dashboard.

Frequently asked questions

What is the difference between sk_test and sk_live?

Test keys only see test-mode data and move no money; live keys operate on real payments. They are separate universes, so an object created in one is invisible to the other.

Should I use a restricted key?

Yes, wherever practical. Restricted keys grant per-resource read or write access, so an automation that reads charges cannot also refund them.

Where does the signing secret come from?

It is filled in automatically when the Stripe trigger creates its own webhook endpoint. For a manually configured endpoint, copy the `whsec_` value from that endpoint's page in the dashboard.

Why does signature verification keep failing?

Each webhook endpoint has its own signing secret. Using one endpoint's secret to verify another's events always fails.

Nodes that use Stripe API

One credential works across every node below — create it once and reuse it.

Last updated . Spotted something wrong? Tell us.