Use of restricted keys

[gertjanspriensma]

As this tap is only using read access to a few resources it would be better to allow the use of restricted keys instead of using the live key. At the moment I think the tap access /account, which makes the use of the restricted key not possible, but I don't think that is necessary.

Exposing the live key is not ideal when you want to use this in a team where not all members should have access to the live keys.

[luandy64]

Just to clarify, you tried using a restricted key as the client_secret in a config file and the tap fails?

[gertjanspriensma]

Yes exactly. I gave the restricted key all permissions to test this, but even then it fails. Below the error I get.

INFO message='Request to Stripe api' method=get path=https://api.stripe.com/v1/account
INFO METRIC: {"type": "timer", "metric": "http_request_duration", "value": 0.573206901550293, "tags": {"endpoint": "account", "status": "succeeded"}}
INFO message='Stripe API response' path=https://api.stripe.com/v1/account response_code=403
INFO error_code=None error_message="The provided key does not have the required permissions for this endpoint on account. This is a restricted API key, but the required permissions are not available for use by restricted keys." error_param=None error_type=invalid_request_error message='Stripe API error received'

[luandy64]

restricted keys cannot interact with many parts of Stripe’s API.

From their docs. So this is a stripe issue, not a tap issue

[gertjanspriensma]

Hm, maybe that is true, but I think that all data sources you need for this tap can be accessed with a restricted key.

It is only the access to the account that is not allowed with a restricted key which, as far as I can see, the tap only use to verify the connection (init.py line 172)

[luandy64]

all data sources you need for this tap can be accessed with a restricted key.

This is not true exactly because if you can't authenticate, you can't access anything

[gertjanspriensma]

But I think you can authenticate with the restricted key, that is not the problem. The problem is that the verify part (which can be done differently I assume) accesses the account information.

You know better how the tap works, but it seems that this information is not used later on, so it basically is only used to show the display_name in the logger.

# Verify connectivity
account = stripe.Account.retrieve(Context.config.get('account_id'))
msg = "Successfully connected to Stripe Account with display name" \
      + " `%s`"
LOGGER.info(msg, account.display_name)

[luandy64]

The problem is that the verify part (which can be done differently I assume)

If you know of a different way to verify the connection, please share. The tap follows the authentication steps outlined in Stripe's Python API Docs.

And speaking of, I'd encourage you to try and test your restricted key with curl in a terminal. Again from their docs:

curl https://api.stripe.com/v1/charges \
  -u sk_test_lSdFJGez2NjhbiCDR4KXhAFR:
# The colon prevents curl from asking for a password.

Replace sk_test_lSdFJGez2NjhbiCDR4KXhAFR above with your key and you'll either see a similar error to the tap, or you'll have proof that the restricted key works and we should investigate the tap more.

[markalexander]

Hi @luandy64 ,

Using curl as above with a restricted key works fine for me. The key in question has read-only access to all resources and is definitely restricted (starts with rk_).

[trov-madisonhope]

We still see this issue in our environments.