Stripe setup guide

Agents read payments, invoices and accounts. Anything that moves money is tier 4: a person always approves it.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Stripe, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Restricted API key

API key.

1. In the Stripe Dashboard open API keys (https://dashboard.stripe.com/apikeys). Use live mode for real data, or a sandbox (keys start rk_test_) to try things first.
2. Click Create restricted key and start from zero permissions. If Stripe asks how the key will be used, you can choose the option for authorizing agent access to your account: Stripe then also holds refunds and subscription cancellations for a reviewer under Settings > Approvals, on top of Everdeck's own approvals.
3. Name the key (for example Everdeck) and set these permissions: Write for Customers, Invoices, Charges and Refunds (refunds come under this permission), and Subscriptions; Read for PaymentIntents, Prices, Products and Events. Leave everything else at None.
4. Click Create key, complete the verification code, then copy the key (it starts with rk_live_). Stripe shows a live restricted key only once.
5. Optional, to start work when an invoice is paid or fails, a dispute opens or a subscription ends: save the connection, add the Stripe trigger on the Intake page and copy the address it gives you. In Stripe open Workbench > Webhooks, click Create an event destination, choose Your account and API version 2026-09-30.endive, select only the trigger's event (invoice.paid, invoice.payment_failed, charge.dispute.created or customer.subscription.deleted), choose Webhook endpoint and paste the address. Then click Reveal secret under Signing secret and paste the whsec_ value into Webhook signing secrets here. Each trigger has its own address, so add one destination per trigger and paste every destination's secret, separated by spaces.

Field	What to enter
Restricted API key	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.
Webhook signing secrets (only for Stripe triggers) (optional)	A secret: Everdeck saves it encrypted and never shows it again. Needed only to start work from Stripe events: the signing secret of each event destination you add for a Stripe trigger (step 5), separated by spaces. Leave it empty otherwise.

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Stripe until you delete or rotate it there.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• Search customersTier 0 · ReadReads outside contentstripe_search_customers

  Find customers with Stripe's search query language, for example email:'[email protected]', name~'acme' (substring, 3+ characters), phone:'+6591234567', metadata['crm_id']:'123' or created>1735689600. Combine up to 10 clauses with AND or OR (not both). Results can lag new or changed customers by about a minute; use get_customer when you already have the id.

• Read a customerTier 0 · ReadReads outside contentstripe_get_customer

  Read one customer with address, account balance (negative means credit), default payment method, metadata and current subscriptions with their prices and period ends.

• Create a customerTier 2 · ReversibleReads outside contentstripe_create_customer

  Create a customer to bill. Stripe does not deduplicate customers, so search by email first. The email receives invoices and receipts.

• Update a customerTier 2 · ReversibleReads outside contentstripe_update_customer

  Change a customer's name, email, phone, description, billing address or metadata. Send only what changes; a new email applies to future invoices and receipts.

• List invoicesTier 0 · ReadReads outside contentstripe_list_invoices

  List invoices, newest first, optionally for one customer or subscription and by status (open means finalized and unpaid). Amounts are in the currency's smallest unit (cents). Open invoices past due_date (Unix seconds) are overdue.

• Draft an invoiceTier 2 · ReversibleReads outside contentstripe_create_invoice

  Create a draft invoice for a customer with one or more lines, to be paid by bank transfer or card from the emailed link (collection by send_invoice). Nothing is sent or charged until send_invoice. Amounts are in the smallest currency unit (1000 = 10.00 USD).

• Send an invoiceTier 4 · Money or irreversibleReads outside contentstripe_send_invoice

  Email an invoice to the customer's email with a payment link. A draft is finalized first, which fixes its number and amounts. Sending an already-sent invoice emails it again (a reminder). In a sandbox no email goes out.

• List paymentsTier 0 · ReadReads outside contentstripe_list_payments

  List payment attempts (PaymentIntents), newest first, optionally for one customer or since a time. Status succeeded means money was collected; requires_payment_method usually means a decline (see last_payment_error). Use the id with create_refund.

• Refund a paymentTier 4 · Money or irreversibleReads outside contentstripe_create_refund

  Refund a successful payment in full, or partly with amount (smallest currency unit). Money goes back to the original card or account; Stripe emails a refund receipt when the account sends receipts. Partial refunds can repeat until the payment is fully refunded.

• List subscriptionsTier 0 · ReadReads outside contentstripe_list_subscriptions

  List subscriptions, optionally for one customer or price and by status. Without status, canceled ones are left out; use all or ended to include them. Each item shows its price and current_period_end (Unix seconds).

• Cancel a subscriptionTier 4 · Money or irreversibleReads outside contentstripe_cancel_subscription

  Cancel a subscription at the end of the current period (default; the customer keeps access until then and it can still be undone in the Dashboard) or immediately. Record why with feedback and a comment.

• List recent eventsTier 0 · ReadReads outside contentstripe_list_events

  List account events from the last 30 days, newest first, for example invoice.paid, charge.dispute.created or customer.subscription.deleted. type accepts one event name or a wildcard such as invoice.*. Each event carries a snapshot of the object it is about.

What can start work

These events from Stripe can become tasks for your agents through Intake. How Intake works.

An invoice was paid, by card, bank transfer or marked paid out of band (invoice.paid).

Connect Stripe first. Then, on the Intake page, open Webhooks and sources, find the connection under Connections without an address yet and select Get its URL. Give that address to Stripe as the setup steps above describe: Everdeck shows it only once. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

A payment attempt on an invoice failed, such as a declined renewal (invoice.payment_failed).

Connect Stripe first. Then, on the Intake page, open Webhooks and sources, find the connection under Connections without an address yet and select Get its URL. Give that address to Stripe as the setup steps above describe: Everdeck shows it only once. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

A customer disputed a charge with their bank (charge.dispute.created). Evidence is due by a deadline.

Connect Stripe first. Then, on the Intake page, open Webhooks and sources, find the connection under Connections without an address yet and select Get its URL. Give that address to Stripe as the setup steps above describe: Everdeck shows it only once. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

A subscription ended, by request or after failed payments (customer.subscription.deleted).

Connect Stripe first. Then, on the Intake page, open Webhooks and sources, find the connection under Connections without an address yet and select Get its URL. Give that address to Stripe as the setup steps above describe: Everdeck shows it only once. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Stripe later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit.

To stop agents using Stripe, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.