lizabog | Stripe Developers | Page 1

winged scrollBOT Jun 7, 2023, 3:15 PM

#

rapid plinth Jun 7, 2023, 3:16 PM

#

Hello, not quite clear on your question. Are these actual secret keys from other accounts that you are storing? (presumably from an OAuth flow?)

quasi cipher Jun 7, 2023, 3:17 PM

#

yep from an auth flow

rapid plinth Jun 7, 2023, 3:18 PM

#

And what issue is happening when you try to retrieve them?

quasi cipher Jun 7, 2023, 3:19 PM

#

It's not finding them, i'm not even seeing a get request in the logs

rapid plinth Jun 7, 2023, 3:21 PM

#

What isn't finding them? Are you making API requests and Stripe is returning something? Or is Stripe erroring and saying it can't find something?

quasi cipher Jun 7, 2023, 3:23 PM

#

The stripe app, it's making an api call that's getting a 404 (even though when i send a curl request i get a 200, so i do know the secret is being saved), And i'm not seeing the failed request in the logs

rapid plinth Jun 7, 2023, 3:24 PM

#

Can you send me the full response that you are getting?

#

And to be clear, a curl request with the same secret is working, but with some client library you are seeing a 404?

quasi cipher Jun 7, 2023, 3:28 PM

#

the request is coming from the stripe app just a sec adding responses.

#

{
"code": "resource_missing",
"doc_url": "https://stripe.com/docs/error-codes/resource-missing",
"message": "No such secret: '***_token'",
"request_log_url": "https://dashboard.stripe.com/acct_1HMbzqBuYbBGWEPr/test/logs/req_laxgbciFWQ0DAA?t=1686151805",
"type": "invalid_request_error"
}

Error codes

Learn more about error codes and how to resolve them.

Stripe Login | Sign in to the Stripe Dashboard

Sign in to the Stripe Dashboard to manage business payments and operations in your account. Manage payments and refunds, respond to disputes and more.

#

{
"id": "appsecret_5110LuiVx0ff6lNzz4p1CYdV2UYrnO",
"object": "apps.secret",
"created": 1686148719,
"expires_at": 1686166719,
"livemode": false,
"name": "****_token",
"scope": {
"type": "user",
"user": "usr_LmFtZY1NBXuaCg"
}

rapid plinth Jun 7, 2023, 3:35 PM

#

Can you send me the code for the request that you are making? (with the secret key redacted)

#

Checking in to our logs to see what I can find.

quasi cipher Jun 7, 2023, 3:37 PM

#

import Stripe from 'stripe';
import {
createHttpClient,
STRIPE_API_KEY,
} from '@stripe/ui-extension-sdk/http_client';

const stripe = new Stripe(STRIPE_API_KEY, {
httpClient: createHttpClient(),
apiVersion: '2022-11-15',
});
stripe.apps.secrets
.find({
scope: { type: 'user', user: userContext.id },
name: '****_token',
expand: ['payload'],
})

winged scrollBOT Jun 7, 2023, 3:43 PM

#

rapid plinth Jun 7, 2023, 3:47 PM

#

Thank you. And what are you doing when you see the 200? Is it the same call or a similar one?

quasi cipher Jun 7, 2023, 3:54 PM

#

i'm sending the same call but when connected from the account in which i uploaded the app, or just doing a curl:
curl https://api.stripe.com/v1/apps/secrets/find
-u sk_test_
-d name=_token
-d "scope[type]"=user
-d "scope.user"= usr_Jx8WIk0xEmvBAz
-G

rapid plinth Jun 7, 2023, 3:55 PM

#

Thanks, and do you have the response from a successful request that you made this way?

#

Can be helpful to compare

quasi cipher Jun 7, 2023, 3:57 PM

#

Yep sent it above
{ "id": "appsecret_5110LuiVx0ff6lNzz4p1CYdV2UYrnO", "object": "apps.secret", "created": 1686148719, "expires_at": 1686166719, "livemode": false, "name": "_token", "scope": { "type": "user", "user": "usr_LmFtZY1NBXuaCg" }

rapid plinth Jun 7, 2023, 3:57 PM

#

gotcha, apologies for the mixup

quasi cipher Jun 7, 2023, 3:57 PM

#

🙌

long nimbus Jun 7, 2023, 4:04 PM

#

👋 stepping in here as Pompey needs to step away

#

Give me a moment to catch up

long nimbus Jun 7, 2023, 4:25 PM

#

We are still looking into this. Unclear what exactly is going on.

quasi cipher Jun 7, 2023, 4:30 PM

#

Thank you

rapid plinth Jun 7, 2023, 4:37 PM

#

To clarify, is that same stripe.apps.secrets.find code working on one of your accounts but not the other?

#

And does that same curl request work across both accounts?

quasi cipher Jun 7, 2023, 4:39 PM

#

yes exactly

rapid plinth Jun 7, 2023, 4:43 PM

#

And you have set this secret for each user across the two accounts?

quasi cipher Jun 7, 2023, 4:43 PM

#

yep

rapid plinth Jun 7, 2023, 4:57 PM

#

I'm still having trouble looking up the successful request in our logs. Can you try printing out lastResponse.requestId on the object that you get back as the successful response?

quasi cipher Jun 7, 2023, 5:02 PM

#

https://dashboard.stripe.com/test/logs/req_ApVyqZVvOq7WWT

Stripe Login | Sign in to the Stripe Dashboard

Sign in to the Stripe Dashboard to manage business payments and operations in your account. Manage payments and refunds, respond to disputes and more.

rapid plinth Jun 7, 2023, 5:17 PM

#

We are still not having much luck, it looks like we will have to escalate this and get back to you. Can you write in to https://support.stripe.com/?contact=true and then DM me your email address?

Stripe: Help & Support

Find help and support for Stripe. Our support center provides answers on all types of situations, including account information, charges and refunds, and subscriptions information. Get your questions answered and find international support for Stripe.

#

It doesn't need to be too detailed of a description. Just your app code, the responses that you were getting and that you were talking to Pompey on Discord. I can fill in other details from this thread and escalate

winged scrollBOT Jun 7, 2023, 5:19 PM

#

rapid plinth Jun 7, 2023, 5:26 PM

#

So I was able to find these logs finally. It looks like that chargeflow_token secret may actually not exist for usr_LmFtZY1NBXuaCg on acct_1HMbzqBuYbBGWEPr, can you try setting the secret again on that account and see if you can retrieve it after? https://stripe.com/docs/api/apps/secret_store/set
https://stripe.com/docs/stripe-apps/store-secrets#scopes

quasi cipher Jun 7, 2023, 5:36 PM

#

can you elaborate on "may actually not exist for usr_LmFtZY1NBXuaCg on acct_1HMbzqBuYbBGWEPr", is it possible it exists for another account? i'm still able to get it just fine even without setting it again, but not from the app

rapid plinth Jun 7, 2023, 5:38 PM

#

Are you using the API keys from acct_1HMbzqBuYbBGWEPr when doing this? I do see logs of curl requests to get this but only from acct_1HJgaRCYdV2UYrnO so far

#

I do see that you set this secret for that user on acct_1HMbzqBuYbBGWEPr on 5/14 but that secret was also set to expire that day so as far as I can see there isn't a valid secret for that user on acct_1HMbzqBuYbBGWEPr specifically

#

Sorry to take a step back, these secrets exist per user per account. So at the moment it looks like this is a difference of the secret still existing and being valid on acct_1HJgaRCYdV2UYrnO but the secret that was set on acct_1HMbzqBuYbBGWEPr has expired and was not set again.

#

For reference this is the request that created the secret for acct_1HMbzqBuYbBGWEPr https://dashboard.stripe.com/test/logs/req_3woXWarbMzy9sx
It looks like the call came from your node backend, can find what that call would look like in your code...

quasi cipher Jun 7, 2023, 5:41 PM

#

We were under the impression the secrets exist per user per app

rapid plinth Jun 7, 2023, 5:42 PM

#

So this call in your node code will look something like stripe.apps.secrets.create

quasi cipher Jun 7, 2023, 5:45 PM

#

await stripe.apps.secrets.create({ scope: { type: constants.USER , user: userId }, name: constants.TOKEN, payload: token, expires_at: timeStampInFiveHours, });

rapid plinth Jun 7, 2023, 5:47 PM

#

So in your logs I see a bunch of these create requests in the logs for the account that can look up these secret, for the account that cannot look up the secret I am not seeing any requests to create this secret recently

#

Have you checked in to your app's logic around when that create call is made? From here, it looks like on one account your app is creating new secrets when needed but on the other account for some reason this call is not being made. I think the next step would be for you to step through your code when running on acct_1HMbzqBuYbBGWEPr to see why this create call is not being called

quasi cipher Jun 7, 2023, 5:56 PM

#

Thankyou🙌

rapid plinth Jun 7, 2023, 6:03 PM

#

Of course! Thanks for your patience. Let us know if you run in to anything else

#lizabog