Stripe.Secrets reference

AppsSecret

Source: src/Stripe/AppsSecret.ts

A Stripe Apps Secret — a named secret in the Stripe Apps Secret Store, used by UI extensions and app backends. Secrets are unique per (name, scope). Create is upsert: posting the same name and scope replaces payload and expiry. Name and scope are identity; changing them replaces the secret. Destroy deletes it.

Apps secrets have no metadata. Identity is name + scope. list() enumerates account-scoped secrets (user-scoped secrets require a user id and are not returned).

AppsSecret: Creating a Secret

Account-scoped secret

const apiKey = yield* Stripe.AppsSecret("third-party-api", {
  name: "third-party-api",
  payload: "sk_live_example",
  scope: { type: "account" },
});

Generated name

const apiKey = yield* Stripe.AppsSecret("third-party-api", {
  payload: "sk_live_example",
});

AppsSecret: Updating a Secret

const apiKey = yield* Stripe.AppsSecret("third-party-api", {
  name: "third-party-api",
  payload: "sk_live_rotated",
  scope: { type: "account" },
});

AppsSecret: User-scoped secrets

const oauth = yield* Stripe.AppsSecret("user-oauth", {
  name: "oauth-token",
  payload: "tok_example",
  scope: { type: "user", user: "usr_123" },
});

CreateAppsSecret

Source: src/Stripe/CreateAppsSecret.ts

Create or replace a Stripe Apps Secret over HTTP. Account-scoped — binds the API key onto the host, not a specific secret resource.

CreateAppsSecret: Creating a Secret at runtime

const create = yield* Stripe.CreateAppsSecret();
const secret = yield* create({
  name: "third-party-api",
  payload: "sk_live_example",
  scope: { type: "account" },
});

CreateAppsSecretHttp

Source: src/Stripe/CreateAppsSecretHttp.ts Kind: Layer · Provides: Stripe.CreateAppsSecret

HTTP implementation of CreateAppsSecret. Provide it on the Function or Worker Effect.

RestrictedApiKey

Source: src/Stripe/RestrictedApiKey.ts

A least-privilege Stripe API key for a Function/Worker host.

HTTP bindings call token.bind(capability, { permissions }) the same way Cloudflare HTTP bindings attach policies to an AccountApiToken. Stripe restricted keys (rk_…) can only be created in the Dashboard today — POST /v2/iam/api_keys is Stripe Apps private preview. Until that API is generally available, this resource stores the collected permissions and injects either a user-supplied RAK or the account secret key.

RestrictedApiKey: Creating a token

Host token, permissions from bindings

const token = yield* Stripe.RestrictedApiKey("ApiToken");
yield* token.bind`RetrieveProduct`({
  permissions: ["products_read"],
});

Dashboard-created restricted key

const token = yield* Stripe.RestrictedApiKey("ApiToken", {
  value: process.env.STRIPE_RESTRICTED_KEY,
  permissions: ["customers_read"],
});

RetrieveAppsSecret

Source: src/Stripe/RetrieveAppsSecret.ts

Retrieve a bound Stripe Apps Secret over HTTP. Find is keyed by name and scope, both taken from the bound resource.

RetrieveAppsSecret: Reading an Apps Secret

const retrieve = yield* Stripe.RetrieveAppsSecret(apiKey);
const live = yield* retrieve({ expand: ["payload"] });

RetrieveAppsSecretHttp

Source: src/Stripe/RetrieveAppsSecretHttp.ts Kind: Layer · Provides: Stripe.RetrieveAppsSecret

HTTP implementation of RetrieveAppsSecret. Find is keyed by name and scope.