#jpress
dense crest
mortal skiff
Hello! I recommend explaining your issue in more detail, with the exact outcome(s) you want. You can email support directly here: https://support.stripe.com/contact/email
brittle fossil
yep, I've given them a ton of detail but each time it's a new support member who doesn't have context on the issue. They keep linking the generic "card testing" doc page no matter how we try to engage them
mortal skiff
What kind of rate limiting are you seeing?
brittle fossil
The message from stripe is generic, but there are few endpoints in particular that are relevant
Request rate limit exceeded. You can learn more about rate limits here https://stripe.com/docs/rate-limits.
what's troubling is that our whole account got limited by a few bad actors
instead of those tokens/those users specifically
one example was hitting setup_intents using the public token from stripe checkout
mortal skiff
To clarify, are you seeing rate limiting inside Checkout itself, or are you seeing rate limiting after Checkout completes?
brittle fossil
after, these were applied to any api call made using our accounts key
so things like acting on a webhook, etc.
let me confirm, because the first event I'm looking at is checkout success that was rate limited
mortal skiff
When you say "our accounts key" what are you referring to? Your secret API key? Your publishable API key?
brittle fossil
yep, the secret one
at that time, 12 users were unable to create a checkout URL
so
- users do bad stuff with a token generated by checkout that lives on the client
- we see rate limits on our secret key used on our backend to create checkout URLs for other users
The number of users is not huge, but this directly blocked our ability to do business with these users
for seemingly something that is out of our control, it's reasonable for anyone to get a public checkout token.
I'm trying to find someone on the support side that can help validate, or tell us what actually happened that is in our control
mortal skiff
Can you give me a request ID for creating a Checkout Session? Here's how you can find a request ID: https://support.stripe.com/questions/finding-the-id-for-an-api-request
brittle fossil
sure thing, let's see if we logged the required info
so far I've only found lock timeouts. It's interesting that 429s get logged as invalid requests
mortal skiff
You can give me any request ID from your account, that will let me see the rate limited requests as well.
brittle fossil
so here's the error in our sentry instance
but I don't see a corresponding log in stripe
at that time
mortal skiff
Yeah, rate limited requests don't generate a request log.
brittle fossil
ohhh, i see. so any request id will help here?
sorry for misunderstanding
req_AJsoo7SWR25D6N there's a random 402
mortal skiff
Yep, thanks! Looking...