Getting started

Connect Stripe

Backstop reads your billing data and takes the recovery / retention actions you configure — so it needs a connection to your Stripe account. You connect in one of two ways: Stripe Connect (OAuth), the one-click path, or a scoped restricted key you create yourself. We never ask for your Stripe password, and you can revoke us from Stripe at any time. Connecting takes about a minute.

Before you start

  • A Stripe accountyou're an owner/admin on (a Standard account — existing Stripe users, not a fresh Connect sub-account).
  • A Backstop workspace. If you just signed up, you already have one; the dashboard greets you with a Connect Stripe step until you do.
  • Five minutes. The OAuth path is a single consent screen; the restricted-key path means ticking a permission list in your Stripe dashboard.

Pick how to connect

On the Connect Stripe screen you choose a method first — two tabs at the top:

Stripe Connect (OAuth) — one-click, fastest

Click Connect Stripeand authorize on Stripe's own consent screen. The grant is read_write — recovery and retention need to acton your account (retry invoices, apply coupons, pause / cancel / switch plans), not just read it. Stripe's OAuth scopes are coarse by design: there's only read_only vs read_write— no “recovery-only” scope, and you can't drop individual capabilities from an OAuth grant. We never receive your secret key with OAuth, and you revoke us from Stripe in one click.

Scoped API key — you set the limits

Paste a Stripe restricted key (rk_…) plus your publishable key (pk_…). Because you scope the key yourself, this is the only way to deny money-movement at the grant itself — with refunds, payouts, balance, and transfers set to No access, Backstop is technically unable to move money out of your account, enforced by Stripe rather than trusted to our code. In the restricted-key editor:

  • Write access on: Subscriptions, Invoices, Coupons, Customers, Checkout Sessions, SetupIntents, Webhook Endpoints (Backstop creates its webhook with this key, so this write permission is required), and Payment Method Domains (so Apple Pay / Google Pay / Link can render on your hosted card-update and portal pages).
  • No access on: Refunds, Payouts, Balance, Transfers — and everything else.

Not sure which to pick? See exactly what Backstop can and can't do on your account — the same link sits under the connect chooser. OAuth is faster; a scoped key is the strongest guarantee.

What we'll do (OAuth)

  1. You click Connect Stripe from the workspace dashboard.
  2. Stripe shows you a consent screen for a read_write connection to your account (customers, subscriptions, invoices, payment intents). You confirm.
  3. We mirror the data into our database via Stripe's webhook events. Every cancel page, every recovery campaign, every analytics view reads from this mirror — never live from Stripe. Writes only happen for the specific actions below.

What we read

  • customer.* — customer mirror (email, name, metadata)
  • customer.subscription.* — subscription state, billing interval, amount
  • invoice.* — paid / failed / finalized invoices
  • charge.*, payment_intent.* — to detect failures and retries

What we write

The read_writegrant (or the Write scopes on your restricted key) exists so Backstop can take the recovery and retention actions you configure. Every write is triggered by one of your rules or a customer's own choice — never speculatively:

  • Smart retries — we re-attempt failed invoices on a decline-code-aware schedule (rules, not ML) via invoices.pay.
  • Save offers — when a customer accepts an offer in your cancel flow, we apply it: a coupon / discount, a pause, a plan switch, or gifted free months (subscriptions.update, coupons).
  • Cancellations — a confirmed cancel sets cancel_at_period_end on the subscription.

What we don't do

  • We never see or store your Stripe secret key over OAuth — Connect tokens only. If you connect with a restricted key instead, that key is encrypted at rest (AES-256-GCM) and never exposed to the browser.
  • We never modify a subscription speculatively. Writes fire only from a recovery rule you set up or an action a customer takes in your flow — never on a whim.
  • We never touch anything outside billing— no Stripe settings, no payouts, no Connect account configuration. With a scoped key, refunds / payouts / transfers are denied at the grant, so this isn't just policy — Stripe blocks it.

Verify the connection is live

  1. After you authorize, Stripe sends you back to your dashboard. A successful key connect returns to /app/<your-workspace>?stripe=connected — the Connect Stripe step is replaced by your live billing data.
  2. Give it a moment to backfill. Backstop mirrors via webhooks, so your customers, subscriptions, and recent invoices populate as the events flow in. Once you see your real customers in the dashboard, the connection is working.
  3. If the dashboard still shows the Connect Stripeprompt, the grant didn't complete — start the connect again. A live/test key mismatch or a missing Webhook Endpoints permission (restricted-key path) surfaces an inline error explaining exactly what to fix.

Disconnecting

Go to your Stripe dashboard → Settings → Connected applications → Backstop → Revoke access. We immediately stop processing webhooks for your account — a revoked connection is a hard kill switch, with in-flight recovery abandoned — but the mirror data we've already collected stays in our DB until you delete the workspace. To wipe the mirror too, delete the workspace from Settings → Workspace. (Connected with a restricted key? Roll or delete the key in your Stripe dashboard to cut us off.)

Next

After Stripe is connected, ship your first cancel flow.