jasontheadams - Connect | Stripe Developers | Page 1

sacred gorge Dec 3, 2021, 12:17 AM

#

Hello again!

First question: I see that we're using the live refresh token combined with the test secret key to retrieve the test token. Is this correct?

I don't think refresh tokens are test or live, they exist at the account level. See the second paragraph under the code snippet in this section: https://stripe.com/docs/connect/oauth-reference#post-token-request

When using a refresh token to request an access token, you may use either a test or live API key to obtain a test or live access token respectively. Any existing access token with the same scope and mode—live or test—is revoked.

manic vessel Dec 3, 2021, 12:21 AM

#

Yeah, I saw that. At first I thought that may be our problem, but it turns out that's perfectly valid.

sacred gorge Dec 3, 2021, 12:21 AM

#

Second question: In the data sent back to their website, we're providing the live and test tokens retrieved from oauth, but we're passing the platform live and test publishable keys. Is this correct?

Which "live and test tokens retrieved from oauth" are you referring to exactly? The ones starting with sk_test and sk_live?

manic vessel Dec 3, 2021, 12:23 AM

#

What's weird about this whole thing is our problem (with Checkout, as described in the other thread) only occurs in test mode, not live.

Yes, exactly. The tokens returned from OAuth: an "authorization_code" grant type for the live token, and "refresh_code" grant type for the test token — in two respective requests.

sacred gorge Dec 3, 2021, 12:26 AM

#

Sorry, I'm not following. You said you're passing four total things to the connected account/website, right? Two of those things are your platform's live and test publishable keys. What are the other two things?

manic vessel Dec 3, 2021, 12:26 AM

#

The other two things are the live and test access tokens:

        return redirect(URL::addQueryString($site->return_uri, [
            'stripe_access_token' => $site->stripe_access_token,
            'stripe_access_token_test' => $site->stripe_access_token_test,
            'stripe_publishable_key' => config('stripe.publishableKey'),
            'stripe_publishable_key_test' => config('stripe.testPublishableKey'),
            'stripe_user_id' => $site->stripe_user_id,
            'connected' => 1,
        ]));

sacred gorge Dec 3, 2021, 12:28 AM

#

Okay, so it sounds like you should be passing the publishable key you get back from OAuth, not your platform's publishable key, if I'm understanding correctly.

manic vessel Dec 3, 2021, 12:30 AM

#

Yeah, I was wondering about that. What's strange is that this code has worked for years and only recently test stopped working (live still works). Perhaps we've been living on some kind of edge case that works in Stripe, but is being phased out?

sacred gorge Dec 3, 2021, 12:33 AM

#

I think that could very well be the case, yeah.

#

It's very unusual to use a secret key obtained from OAuth with a publishable key not obtained via OAuth.

#

Are you using the publishable key from the OAuth process for anything?

manic vessel Dec 3, 2021, 12:34 AM

#

Not a thing. Hahah! Honestly, someone wrote this code 4ish years ago and it's "just worked" so we haven't touched it.

#

We use the access tokens and toss the publishable keys to the wind.

#

I'm sure it made sense at the time? 😅

sacred gorge Dec 3, 2021, 12:36 AM

#

Uh... okay. 😅

#

But yeah, you should use those. This is for a plugin, right? Something that runs on other people's infrastructure you don't control?

manic vessel Dec 3, 2021, 12:37 AM

#

Exactly. It's a distributed, self-hosted product. Otherwise we'd be using the header like good kids.

#

In fact, exactly this from the Stripe docs:

For example, if your platform operates as a plugin for WordPress or other self-hosted software, you can make API requests directly from the plugin where your platform’s API keys are not available.

sacred gorge Dec 3, 2021, 12:39 AM

#

Yeah, so in that scenario you should be passing both the secret and publishable keys you get from OAuth for the plugin to use, not your platform's keys.

manic vessel Dec 3, 2021, 12:40 AM

#

Got it. But we're still able to use those to apply our own fees, right?

sacred gorge Dec 3, 2021, 12:41 AM

#

What do you mean?

manic vessel Dec 3, 2021, 12:42 AM

#

On the customer site, under certain conditions, we add a platform fee of 2% to the transaction. I'm just making sure switching the publishable keys won't somehow cause problems.

sacred gorge Dec 3, 2021, 12:43 AM

#

Switching the keys in the way we've been talking about should not impact fees in any way.

manic vessel Dec 3, 2021, 12:44 AM

#

Awesome. Ok, I'm going to test this out now. Thanks so much for your help!

#jasontheadams - Connect