Sapilon becomes publicly available on 15 November 2026: 34 days to go. The core goes open source the same day →

Stripe integration

In short

Read customers, payments, invoices and subscriptions. Connect it on the Integrations page; your app then calls Stripe through Sapilon without ever holding a Stripe credential.

Lets your app read customers, payments, invoices and subscriptions, and create customers and invoices, with a restricted API key you create in Stripe.

Use a restricted key (rk_…) with only the permissions you need, and a test-mode key for the Build Server.

Connecting

On the Integrations page choose Connect on Stripe and fill in:

  • Restricted API key — Stripe Dashboard → Developers → API keys → Create restricted key. Grant Read on Customers, PaymentIntents, Invoices and Subscriptions (Write on Customers and Invoices if the app creates them).
  • Webhook signing secret (for events) (optional) — After connecting, add the events URL shown here as a webhook endpoint in Stripe and paste its signing secret.

Sapilon checks the key with the provider before it saves it, and stores it encrypted; it is never shown again.

  • Use a restricted key, not your secret key.
  • Use a test-mode key for the Build Server.

What your app can do

Only these requests are available; anything else is refused.

  • GET|POST /customers
  • GET /customers/*
  • GET /payment_intents
  • GET /payment_intents/*
  • GET|POST /invoices
  • GET /invoices/*
  • GET /subscriptions
  • GET /subscriptions/*

Events

Your app can react to: payment_intent.succeeded, invoice.paid, invoice.payment_failed, customer.subscription.updated, customer.subscription.deleted. After connecting, open the connection and choose Show events URL, then add that address as a webhook in the provider’s dashboard. The URL is a secret — treat it like a password.

How the agent uses it

Use integrations.request('stripe', …); paths are relative to https://api.stripe.com/v1. Stripe takes form-encoded bodies: send body as a string such as email=a%40b.com with headers: { 'Content-Type': 'application/x-www-form-urlencoded' }.

  • GET|POST /customers, GET /customers/{id} — Example: { method: 'GET', path: '/customers', query: { email: 'a@b.com' } }.
  • GET /payment_intents, GET /payment_intents/{id} — Example: { method: 'GET', path: '/payment_intents', query: { limit: '10' } }.
  • GET|POST /invoices, GET /invoices/{id} — Example: { method: 'GET', path: '/invoices/in_123' }.
  • GET /subscriptions, GET /subscriptions/{id} — Example: { method: 'GET', path: '/subscriptions', query: { customer: 'cus_123' } }.

Payments and subscriptions are read-only. Events: integrations.on('stripe', 'payment_intent.succeeded', handler).

More from Stripe: https://docs.stripe.com/api

Last updated .

Was this page helpful?