timraybould_unexpected | Stripe Developers | Page 1

feral tundraBOT Apr 11, 2024, 6:21 PM

#

👋 Welcome to your new thread!

⏲️ We'll be here soon! Typically we respond in a few minutes, but sometimes we might take a bit longer if the server is busy or if you have a particularly tricky question.

⏱️ We close idle threads, which makes them read-only. Once a thread is closed it won't be reopened, but you can always start a new thread if you have another question.

🔗 This thread will always be available, even after it's closed. You can find it again using Discord's search, or you can save this link: https://discord.com/channels/841573134531821608/1228047197933932594

📝 Have more to share? Add more details, code, screenshots, videos, etc. below.

stark beaconBOT Apr 11, 2024, 6:21 PM

#

bleak vault Apr 11, 2024, 6:22 PM

#

Hi 👋

Do you have examples of the failing requests?

harsh temple Apr 11, 2024, 6:27 PM

#

Hi, yes. req_c4qXSeaBc03jfQ

#

another: req_7bzVm73Fsgj1cn

#

third (let me know if you need more): req_3rxLavdqsWaUuX

bleak vault Apr 11, 2024, 6:29 PM

#

THe error being returned says your Stripe app needs to request more permissions

harsh temple Apr 11, 2024, 6:30 PM

#

exactly. But I have verified that my app has read_write for PaymentIntents for this connected account.

bleak vault Apr 11, 2024, 6:30 PM

#

Can you share the contents of your app manifest here?

harsh temple Apr 11, 2024, 6:33 PM

#

do you just want the permissions array in stripe-app.json? or just want my app id?

#

apparently I cannot send long messages in Discord

#

The relevant permissions are:

    {
      "permission": "payment_intent_read",
      "purpose": "To conduct all transactions"
    },
    {
      "permission": "payment_intent_write",
      "purpose": "To conduct all transactions"
    },

bleak vault Apr 11, 2024, 6:38 PM

#

The errors I am seeing for this request suggest

It did not have the PaymentIntent permissions
You need payment_method_read also

harsh temple Apr 11, 2024, 6:39 PM

#

I do have that one as well.

    {
      "permission": "payment_method_read",
      "purpose": "To complete checkout"
    },
    {
      "permission": "payment_method_write",
      "purpose": "To complete checkout"
    },

bleak vault Apr 11, 2024, 6:40 PM

#

Have you always had these permissions as part of your app?

harsh temple Apr 11, 2024, 6:41 PM

#

payment_intent_write I added 2 versions ago (about a month ago), however, I have verified that the user is on the latest version, and, had her check the specific permissions and she confirmed it says "Modify" next to PaymentIntents

bleak vault Apr 11, 2024, 6:44 PM

#

I am looking at the key used to make this request. It's just your publishable key

harsh temple Apr 11, 2024, 6:45 PM

#

Interesting.

feral tundraBOT Apr 11, 2024, 6:47 PM

#

harsh temple Apr 11, 2024, 6:47 PM

#

That does not make much sense. The key I'm using is the secret key. starts with sk and the last few characters match what I see in https://dashboard.stripe.com/apikeys

Stripe Login | Sign in to the Stripe Dashboard

Sign in to the Stripe Dashboard to manage business payments and operations in your account. Manage payments and refunds, respond to disputes and more.

bleak vault Apr 11, 2024, 6:49 PM

#

You said this is being created in a Checkout Session. What is creating the Checkout Session?

harsh temple Apr 11, 2024, 6:50 PM

#

My backend, in node:
const stripe = require('stripe')(body.livemode === "true" ? process.env.STRIPE_SK_LIVE : process.env.STRIPE_SK_TEST)

#

and can confirm that STRIPE_SK_LIVE points to my live key

#

here's the checkout session creation request, from one of those error examples: req_W7zMjXMqqyJFcj

#

I'm not sure how/why or if it matters, but, the API version on the checkout session post request is 2023-08-16 , while, the api version on the payment_intents/:id/verify_challenge endpoint is 2022-11-15.

bleak vault Apr 11, 2024, 6:55 PM

#

And where is this Checkout Session being rendered?

harsh temple Apr 11, 2024, 6:56 PM

#

here's the specific event in question: https://tkt.page/z3nnn8LvWOVc6AgBrFyo ... add one to your cart, then click checkout

violet wren Apr 11, 2024, 6:58 PM

#

hey there, taking a look as my colleague needs to step away soon

harsh temple Apr 11, 2024, 6:58 PM

#

ok. thank you.

violet wren Apr 11, 2024, 7:01 PM

#

Is this something that you can reproduce in test mode too? I'm not able to test the flow on a live mode session that will result in payment

harsh temple Apr 11, 2024, 7:02 PM

#

I haven't been able to reproduce in test mode. It does seem to be related to that pk_ in the POST request

#

any ideas? trying the test 3DS secure cards but can't trigger this specific error

#

seems like js.stripe.com is calling /v1/payment_intents/:id/verify_challenge and that call is failing because of a permissions issue.

#

my backend creates the checkout session and it's rendered on the web, client side. The checkout session is created with my sk_, however, further calls from the client that need to be made by js.stripe are made with pk. Normally everything works fine but in the case where js.stripe needs to call /verify_challenge, it's failing.

violet wren Apr 11, 2024, 7:22 PM

#

All those stripe js calls are handled by checkout, so that bit shouldnt be affected by your integration

harsh temple Apr 11, 2024, 7:22 PM

#

might be a stripe bug?

violet wren Apr 11, 2024, 7:23 PM

#

Possibly - still looking, and going to talk to some teammates.

harsh temple Apr 11, 2024, 7:23 PM

#

ok. thanks. will be here 🙂

violet wren Apr 11, 2024, 7:23 PM

#

Is this happening on all sessions, or just a subset?

harsh temple Apr 11, 2024, 7:24 PM

#

just a subset. small subset

#

across 2 or 3 of my customers

#

but it seems to be happening a lot more with one customer, and they are currently frustrated that transactions aren't going through. it's definitely seems related to the card having to go through an extra verification step. fwiw I know one of the recent ones was trying to use a discover card

#

sorry, not "related" ... it seems exactly connected to the card having to go through an extra verification step

violet wren Apr 11, 2024, 7:28 PM

#

Gotcha, thanks

#

This does seems like a bug on our side -- we're digging into code

harsh temple Apr 11, 2024, 7:36 PM

#

ok

violet wren Apr 11, 2024, 7:39 PM

#

Ok yea this seems like a bug in permissions on our side. Can you please write in to support using https://support.stripe.com/contact/email and include these example failed requests and a short summary?

Contact Us | Stripe: Help & Support

Find help and support for Stripe. Our support site provides answers on all types of situations, including account information, charges and refunds, and subscriptions information. Get your questions answered and find international support for Stripe.

#

If you can do that in the next ~30min I can make sure the issue gets to the attention of the team that needs to look at this

harsh temple Apr 11, 2024, 7:41 PM

#

ok. will do it now

violet wren Apr 11, 2024, 7:41 PM

#

In short, your existing permissions for checkout_session_write should allow all of this implicitly

harsh temple Apr 11, 2024, 7:45 PM

#

ok, email sent. got the canned response, no ticket number

#

do you have an estimate on when this might be fixed, given it's currently preventing orders from going through?

violet wren Apr 11, 2024, 7:52 PM

#

You should be able to see the case in your Dashboard, i think, but its case 12777342 for your reference

harsh temple Apr 11, 2024, 7:53 PM

#

should i update the API version?

violet wren Apr 11, 2024, 7:54 PM

#

For what? But no, i don't think that would be related

harsh temple Apr 11, 2024, 7:57 PM

#

I have this option to upgrade my api version

violet wren Apr 11, 2024, 8:00 PM

#

You can that's up to you, but unrelated to this issue

harsh temple Apr 11, 2024, 8:01 PM

#

ok. thanks for the help. no guess on the timing question for the bug fix?

violet wren Apr 11, 2024, 8:10 PM

#

No, not specifically, but I found your case and am reporting the bug now

harsh temple Apr 11, 2024, 8:11 PM

#

How about non specifically? My customer is selling tickets to an event, and, I could probably get away with telling her it'll be fixed tomorrow, but, if it's going to be several days or longer, I should probably tell her that we need to think of something else.

violet wren Apr 11, 2024, 8:22 PM

#

I would not say you should expect it resolved tomorrow, no

harsh temple Apr 11, 2024, 8:30 PM

#

ok. last question. do you know specifically the scenario that is causing a transaction to hit the bug? Maybe we can seek to manually avoid that scenario somehow in her ticket sales. Like prevent Amex or something.

violet wren Apr 11, 2024, 8:32 PM

#

It looks like it might be automatic captcha related, but i can't say specifically

#

It could also be a card 3ds challenge as you say

harsh temple Apr 11, 2024, 8:35 PM

#

automatic captcha... is there more detail on that? is there a way to trigger that in test mode that you know of?

#

is it stripe that's deciding to show a captcha in some cases? possible to get her account on an allowlist?

#

is there possibly a fraud detection setting that she could turn off?

#

ah ha...

Also, on each page where you load Stripe.js, it may load hCaptcha. hCaptcha is a type of CAPTCHA that helps stop fraud and provides additional signals to Stripe while being low friction for legitimate customers. To opt out of use of hCAPTCHA integration, reach out to Stripe Support.

#

Can you opt her account & mine (?) out of hCAPTCHA?

violet wren Apr 11, 2024, 8:40 PM

#

I can't make that change here unfortunately, but you can request that via Support

#

You can test using the card 4000000000001208 in test mode to see if that allows for repro in test mode

feral tundraBOT Apr 11, 2024, 8:45 PM

#

harsh temple Apr 11, 2024, 8:51 PM

#

that's the 3ds one? yeah I've tried that, no luck.

#

actually, no, that's the captcha one. YES that did it

#

I can now reproduce in test mode

#

could you share which stripe doc page that number came from?

#

don't see it at all here: https://docs.stripe.com/testing

rocky hull Apr 11, 2024, 8:57 PM

#

👋 stepping in for my teammate. Thanks for testing with that card! You're right, this is a card number that is not documented. I recommend getting in touch with our support team to request they turn off hcaptcha for your account. They may request more information on your use case for turning it off

harsh temple Apr 11, 2024, 8:58 PM

#

ok, thanks. for my account as the platform account or the connected account (or both)? Do you think that would help for Stripe Checkout or only stripe.js?

rocky hull Apr 11, 2024, 9:05 PM

#

It should be requested for your platform account (since you're making requests in a Connect context).

#timraybould_unexpected