kbjohnson90-checkout-redirect | Stripe Developers | Page 1

weary condor Dec 1, 2021, 8:01 PM

#

@frank badger that almost always happens because you are mixing up API keys. You're using the Secret API key of one account to create the session and then you redirect with the Publishable API key of another ccount

#

If you use Connect it's likely because you don't initialize Stripe.js properly

#

If you share a bit more details I should be able to help

frank badger Dec 1, 2021, 8:11 PM

#

Does the Account ID substitute for the secret key in this case? I'm not seeing the secret key being used.

#

\Stripe\Checkout\Session::create(
  $args,
  [
    "stripe_account" => "acct_*********",
  ]
);

#

I've tried refactoring to use the secret key of the connected account directly, but am getting the same error.

$stripe = new \Stripe\StripeClient(SECRET);
$stripe->checkout
       ->sessions
       ->create($args);

I've confirmed that the secret key is the value that I expect and have confirmed that the session ID created matches the sessions ID used in the Checkout Redirect for the payment page.

#

Is there some way in my Stripe account that I can check the secret key of the Connect account? I am assuming that the secret that I have is correct, but I also don't see how to confirm that assumption in my account.

craggy plaza Dec 1, 2021, 8:32 PM

#

Does the Account ID substitute for the secret key in this case? I'm not seeing the secret key being used.
you're setting your secret key (presumably) when you initialize Stripe PHP in your backed

the acct_123 Connect account ID allows you to make API requests on that Connect account, it isn't a substitute for the API key

#

I've tried refactoring to use the secret key of the connected account directly

please don't do that

#

that is highly not recommended and will only give you more trouble down the line

frank badger Dec 1, 2021, 8:33 PM

#

I'll roll that change back then 😅

craggy plaza Dec 1, 2021, 8:33 PM

#

Is there some way in my Stripe account that I can check the secret key of the Connect account?
so yeah you're going down a rabbit hole you should not, your actual issue is somewhere else to fix, let me explain

#

let's start here

#

how are you redirecting to Checkout?

frank badger Dec 1, 2021, 8:42 PM

#

Using stripe.redirectToCheckout() method, passing the session ID.

#

Inspecting the network requests, I was able to confirm that the secret key returned during the Connect process is the same secret key being used in initializing Stripe.

craggy plaza Dec 1, 2021, 9:07 PM

#

ok so

#

how are you initializing Stripe.js on your webpage

#

that is what I think is the problem here

#

alternatively

#

you dont' need to use redirectToCheckout

#

when you create the CheckoutSession, it has a url field

#

so you can just redirect to it there

frank badger Dec 1, 2021, 9:11 PM

#

Stripe JS is initialized using an inline script, passing the publishable key and the account ID.

stripe = Stripe( '<?php echo $publishable_key; ?>', {
  'stripeAccount': '<?php echo $stripe_account_id; ?>'
} );

and then redirecting

stripe.redirectToCheckout({
  sessionId: '<?php echo $session_id; ?>'
})

craggy plaza Dec 1, 2021, 9:12 PM

#

is the publishable key of the Platform account?

frank badger Dec 1, 2021, 9:13 PM

#

The publishable key matches the value returned during the Stripe Connect flow (stripe_publishable_key_test)

#

The https://checkout.stripe.com/pay/ url listed in a dump of the session doesn't match the real URL redirected to. The session ID matches in both versions of the URL, but the value after the # is different.

craggy plaza Dec 1, 2021, 9:27 PM

#

yeah that is the incorrect part

#

you're using the Connect acct key

#

that is wrong

#

you need the Platform's publishable key

#

basically, ignore the keys you get in Stripe OAuth flow

#

also

The https://checkout.stripe.com/pay/ url listed in a dump of the session doesn't match the real URL redirected to. The session ID matches in both versions of the URL, but the value after the # is different.
them being diff is fine

#

just use the url you get back in the Session object

frank badger Dec 1, 2021, 9:33 PM

#

Hm... Not recognizing a platform publishable key.

#

I'll mention that this is a distributed codebase (WordPress plugin) and a partner account.

#

Does that change anything?

craggy plaza Dec 1, 2021, 9:33 PM

#

ah well.... it does and does not

frank badger Dec 1, 2021, 9:34 PM

#

🙂

craggy plaza Dec 1, 2021, 9:34 PM

#

what is your plugin approach, you're using OAuth to connect to new Stripe accounts right

frank badger Dec 1, 2021, 9:34 PM

#

Correct.

#

We have a "Connect to Stripe" button within the admin interface.

craggy plaza Dec 1, 2021, 9:36 PM

#

so in that case, you use my approach that I recommended, i.e.

Platform secret / publishable key
+
Stripe-Account header

https://stripe.com/docs/connect/authentication

#

now to your most recent question

#

Hm... Not recognizing a platform publishable key.
what does that mean? like any errors? what is the issue

#

and

#

why won't you go with my easier advice lol

#

just use the url you get back in the Session object
just saying

frank badger Dec 1, 2021, 9:37 PM

#

Using the url returned by the session, instead of using redirectToCheckout() with the session ID, would be a significant refactor for this codebase.

craggy plaza Dec 1, 2021, 9:39 PM

#

ok so

#

DM me how you initialized Stripe.js with full unredacted publishable key and Stripe Account ID

#

they are public so fine to share but still don't paste here

#

just DM me

#

so I can look

#

ok so can you share a test mode CheckoutSession ID?

#

looked at the two you sent, those look fine

#

wondering if you're using the "Connect OAuth" API keys in your CheckoutSession creation

frank badger Dec 1, 2021, 9:50 PM

#

cs_test_a1kAPC0omFgZPyMHedU22FNt2nWsd7FSfyOPRdVnZEjDLMbQD5IWnBaLh9

craggy plaza Dec 1, 2021, 9:53 PM

#

ok so your server-side code and client-side code seems to be initialized correctly

I'm gonna talk through some stuff to see if there is something I missed

#

is there a request ID from when you call redirectToCheckout() ?? and what is the error you get?

frank badger Dec 1, 2021, 9:56 PM

#

stripe.redirectToCheckout (JS) returns a promise with a state of pending.

craggy plaza Dec 1, 2021, 9:58 PM

#

are you await 'ing that promise

#

or chaining a then() to it

frank badger Dec 1, 2021, 9:59 PM

#

Chaining a then().

craggy plaza Dec 1, 2021, 10:00 PM

#

I'll be stepping away but a colleague is joining
feel free to ask them qs

frank badger Dec 1, 2021, 10:00 PM

#

Thank you for your time - I very much appreciate it.

foggy spoke Dec 1, 2021, 10:02 PM

#

Hello! Catching up...

frank badger Dec 1, 2021, 10:02 PM

#

To clarify, this is a solution that we have been using for a while now. We process a lot of transactions through Stripe.

#

We haven't made any changes in the past couple of months, but are now getting reports that the Checkout Redirect is resulting in an error.

foggy spoke Dec 1, 2021, 10:09 PM

#

When exactly did this start to happen?

frank badger Dec 1, 2021, 10:10 PM

#

The report came in about 6 hours ago.

#

Looking at GitHub, I don't think that we have touched this part of the codebase in 4 months.

foggy spoke Dec 1, 2021, 10:15 PM

#

Is it happening for every Checkout Session or just some?

frank badger Dec 1, 2021, 10:17 PM

#

As far I can tell all Checkout Sessions. We have a customer report and I have been able to reproduce the issue locally, consistently.

foggy spoke Dec 1, 2021, 10:22 PM

#

Is this happening in test mode only, or also in live mode?

frank badger Dec 1, 2021, 10:24 PM

#

Just tried Live for the first time, which works as expected. Therefor, I would say it has only been using Test keys.

foggy spoke Dec 1, 2021, 10:26 PM

#

Okay, I found one of the error requests: https://dashboard.stripe.com/test/logs/req_a0NoPaGQmAuyp5

#

Does that link work for you?

frank badger Dec 1, 2021, 10:27 PM

#

No. No request log found with the specified ID.

foggy spoke Dec 1, 2021, 10:27 PM

#

Ah, you must be logged in to a different account.

#

Can you switch to the account with the ID ending in oXI and try the link again?

frank badger Dec 1, 2021, 10:30 PM

#

Looks like the correct account, as far as I can tell.

foggy spoke Dec 1, 2021, 10:30 PM

#

It does look like you're using the wrong publishable key, which belongs to a completely different account which ends with usL.

frank badger Dec 1, 2021, 10:30 PM

#

Are you able to see an account name on that? Or is there a place in the dashboard that lists the account ID?

foggy spoke Dec 1, 2021, 10:30 PM

#

Go here and scroll to the bottom: https://dashboard.stripe.com/settings/user

frank badger Dec 1, 2021, 10:31 PM

#

Ah, ok. Thanks.

#

I'm not seeing an account ending in usL.

#

Also, I can confirm that I was attempting to view the log using the account ending in oXI.

foggy spoke Dec 1, 2021, 10:32 PM

#

Can you see this request? https://dashboard.stripe.com/test/logs/req_76h4U8vNwEOONd

frank badger Dec 1, 2021, 10:33 PM

#

Yes, I can see that one.

foggy spoke Dec 1, 2021, 10:35 PM

#

Hm, I guess we don't show these requests in the Dashboard... probably because they come from Checkout itself I suppose. Hang on...

#

So the publishable key you're using is the one that ends with xE1i, correct?

frank badger Dec 1, 2021, 10:36 PM

#

Correct. The publishable key that I am using ends with xE1i.

foggy spoke Dec 1, 2021, 10:40 PM

#

That publishable key belongs to the account ending in usL, which is why it's not working.

frank badger Dec 1, 2021, 10:42 PM

#

Ah, ok. Hm... That is the publishable key returned by the OAuth connection request.

#

Or perhaps it is coming from our own connect server? Hm.

#

I'll have to look into that.

foggy spoke Dec 1, 2021, 10:43 PM

#

That is the publishable key returned by the OAuth connection request.

I do not think this is the case.

#

If it was the case I think it would work.

frank badger Dec 1, 2021, 11:02 PM

#

Then perhaps there is an issue with our connect server.

#

That is the key that I'm getting, but it may be what is sent by the middle man.

foggy spoke Dec 1, 2021, 11:02 PM

#

Yeah, I think whatever is sending you that key is sending the wrong thing.

frank badger Dec 1, 2021, 11:22 PM

#

Thanks for your help! I really appreciate it.

#kbjohnson90-checkout-redirect