tvanantwerp_error | Stripe Developers | Page 1

wise cairnBOT May 9, 2024, 8:40 PM

#

👋 Welcome to your new thread!

⏲️ We'll be here soon! Typically we respond in a few minutes, but sometimes we might take a bit longer if the server is busy or if you have a particularly tricky question.

⏱️ We close idle threads, which makes them read-only. Once a thread is closed it won't be reopened, but you can always start a new thread if you have another question.

🔗 This thread will always be available, even after it's closed. You can find it again using Discord's search, or you can save this link: https://discord.com/channels/841573134531821608/1238229035457445891

📝 Have more to share? Add more details, code, screenshots, videos, etc. below.

ashen arrow May 9, 2024, 8:41 PM

#

This is the documentation that seems most relevant to my error: https://docs.stripe.com/stripe-apps/api-authentication

API authentication methods

Select the API authentication method that works best for your app's use case.

velvet horizon May 9, 2024, 8:42 PM

#

Hmm

#

What value, if any, is in your stripe_api_access_type of build/manifest.js?

#

(if you omit setting your own)

wise cairnBOT May 9, 2024, 8:44 PM

#

ashen arrow May 9, 2024, 8:44 PM

#

Until today, none of the apps I've been working on have any stripe_api_access_type property in the stripe-app.json file. I think it's something rolled out very recently and which we weren't aware of until now.

#

I tried setting stripe_api_access_type to platform, which most closely resembles how the app already works—we interact with Stripe in our backend via API keys from the app's publishing account. But I got a different error after that, telling me I couldn't use platform for an app that's already set to be public.

#

Request failed, status=400, body={
  "error": {
    "message": "9:Setting stripe api access type to 'PLATFORM' not allowed for app distribution 'PUBLIC' because the app is already published",
    "request_log_url": "https://dashboard.stripe.com/test/logs/req_BGwSDBOcVUOboq?t=1715287581",
    "type": "invalid_request_error"
  }
}

velvet horizon May 9, 2024, 8:51 PM

#

And if you set nothing, that's when you encounter STRIPE_API_ACCESS_TYPE_INVALID?

ashen arrow May 9, 2024, 8:51 PM

#

Correct.

#

The stripe-app.json didn't previously have "distribution_type": "public" either, but it's being added automatically when I run stripe apps upload.

velvet horizon May 9, 2024, 8:57 PM

#

We're taking a look -- my colleague @crimson trellis is going to do some digging.

#

Core question: for an existing publicly distributed app, what should you set (if anything) for stripe_api_access_type to be able to publish a new version using the existing pattern?

#

(or how to otherwise handle this)

ashen arrow May 9, 2024, 8:59 PM

#

Yes.

I tried uploading a minor change to a different Stripe app that also lacked these properties in stripe-app.json, and it gave me no issues. I don't know why one app upload would fail, yet the other was fine.

crimson trellis May 9, 2024, 9:12 PM

#

👋 Just to be clear, for the other app where the minor change was successfully uploaded, is this app published or not?

ashen arrow May 9, 2024, 9:13 PM

#

Yes, the other app is also published and in use by users.

#

I just discovered this in the settings of the app that had the error. This must be a new setting. I'm not sure how or why it got set to OAuth. The other app that succeeded was set to Platform in the same dashboard settings.

crimson trellis May 9, 2024, 9:15 PM

#

Interesting, okay.

#

Since the app that had the error is set to oauth, could you try uploading your change but using stripe_api_access_type: oauth ?

ashen arrow May 9, 2024, 9:20 PM

#

Not without specifying a list of allowed redirect URIs. Which we don't have, because the app was never built for this auth flow.

crimson trellis May 9, 2024, 9:22 PM

#

Got it

ashen arrow May 9, 2024, 9:24 PM

#

I'm also unsure what other implications it would have to explicitly switch to the OAuth flow. Currently, we store access tokens to a 3rd party service in the secret store. We access them on behalf of users with the publishing account's Stripe API key. From reading the docs on using OAuth, it sounds like the expectation is that our backend would store the tokens instead to communicate with Stripe.

crimson trellis May 9, 2024, 9:24 PM

#

Digging into your app logs on my end to see what else I can find

#

Okay, it looks like the authentication type was moved from platform to oauth back in December when a stripe-app.json file was uploaded with stripe_api_access_type: oauth . We recently made a change to prevent published apps from changing authentication type, which is why you're not able to change this back to platform. I've flagged this to our team so we can get this app back to the right state. I assume your team has a Stripe contact already who you can flag this too as well?

#

If you don't have a direct contact, I recommend writing into our support team so we can follow up with next steps: https://support.stripe.com/contact/

You can flag in your message to support that you discussed this issue with developer support on Discord. If you end up writing in to support now, let me know when you've submitted your message so I can pull it up.

ashen arrow May 9, 2024, 9:59 PM

#

Yes, we've got contacts. Thank you for looking into this!

If someone from my team added the auth type in December, they didn't save the stripe-app.json changes in the repo. I'll have to find out what happened.

#tvanantwerp_error