Security, permissions, and access levels when connecting your Stripe account to a third-party platform

Starting in July 2021, Platforms can request only one type of permission when connecting to your Stripe accounts: read and write. In addition, Stripe will begin to enforce a single platform connection policy: Only one Platform can be connected to a Stripe account at any one time. This change ensures that in the rare case that a user interacts with two platforms, each platform’s activity is kept distinct in separate accounts.

Extensions will continue to be able to request the read only permission. Extensions can also continue to connect to accounts where there may be another Platform or Extension that is already connected. They are not restricted by the single connection policy and their integration behavior will remain unchanged.

Read only

Extensions like Baremetrics or Intercom may use read only to provide you with deeper views and insights into your Stripe data. They cannot create charges on your behalf.

Read and write

Platforms like Squarespace or Moonclerk use the read and write permission to help their users accept payments online. Using this permission allows the connecting application to create subscriptions, customers, charges, refunds, and more. They cannot view credit card numbers or copy them off of Stripe.

If a seller needs help with a payment or transaction, the platform owner can look up the details either using the API or by getting a limited view of the user’s Dashboard. This limited view can help the platform troubleshoot with their users if there are any problems. Platforms also have the ability to create and access data on connected accounts via the API.

When you create an account while onboarding to a platform, that account will be automatically enabled with Platform Controls. Platforms will be able to apply a set of new controls on these accounts and manage additional settings, such as payout schedules, on your behalf.

Using Stripe with multiple platforms

Users won’t be able to connect multiple platforms to the same account due to the single Platform connection policy. Instead, users that plan to use Stripe with multiple platforms can create individual accounts under the same Stripe user login to connect to different platforms.

During the onboarding flow, Stripe automatically detects if a user has existing accounts that can be connected to the platform. Accounts that are already connected to a platform will not be shown. Users will be directed to create a new account instead. When creating this new account, the user can choose to share a legal entity, and then they will be able to re-use data from an existing account to quickly and easily complete the onboarding flow.

Alternatively, users can choose to create a new legal entity and a new account by clicking “Create new” in the onboarding flow instead.

Security and revoking access

You can check the Authorized Applications page to see who is connected to your Stripe account.

Revoking a Platform’s access

If you created your account by registering on Stripe first, and then connected it to a platform, you’ll be able to revoke a platform’s access at any time from the Authorized Applications page. After revoking access, you will be able to connect your account to a different Platform as long as there are no other Platforms connected, i.e. only a single platform can be connected to an account at any one time.

If an account is enabled with Platform Controls, you’ll see that you cannot revoke the platform’s access to that account.

Revoking an Extension’s access

You’ll be able to revoke access to any Extensions connected to your account at any time from the Authorized Applications page.

FAQ

What is the difference between my platform controls enabled Stripe account vs. a direct Stripe account?

Accounts that users create during the onboarding process to a platform will be automatically enabled with Platform Controls. Accounts that a user creates when registering with Stripe are considered direct Stripe accounts. Direct Stripe accounts will not be platform controls enabled. For more details about accounts that have been enabled with Platform Controls, please see: Platform Controls for connected accounts

What happens if multiple platforms are currently connected to my Stripe account?

Users with multiple platforms currently connected to their account will continue to stay connected to those Platforms. Users always have the ability to revoke those Platforms’ access. Please note that, if you do disconnect and then want to reconnect, your account will now be subject to the single platform connection logic. When going through the onboarding flow to the platform you’ll be directed to create a new account.