Stripe

What it watches

Stripe feeds Revenue Guard: payments against a learned baseline, webhook health, checkout evidence.

What Keelnest reads

• Credential: Read-only restricted key.
• Reads: events, webhook endpoints, payment aggregates.

Stripe keeps events 30 days. Live webhooks retry up to 3 days, then the endpoint is disabled. Every hour Keelnest also reads where the webhook endpoints point and which events they listen to, and looks for a Stripe test key in the live site's code. When a Stripe key leaks, Keelnest also counts failed charges, refunds, payouts and transfers since then from the same events.

Read-only, like every connection: Keelnest never refunds, charges, changes a price, edits a setting or an environment variable, merges on its own or runs a migration. The credential is checked with one read call before it is stored, encrypted at rest, and can be revoked at the provider at any time. Security says the whole of it.

How to connect

1. Create the restricted key. Stripe Dashboard > Developers > API keys > Create restricted key. Grant read access to Events, Webhook Endpoints, Charges and Checkout Sessions. Nothing else. Open Stripe.
2. Paste it into Keelnest. In your workspace, open Integrations, find Stripe and press Connect. Keelnest makes one read call to confirm the credential works, stores it encrypted, and starts reading on the next five-minute tick.
3. Link the apps. Under Manage, pick which applications this account watches. An app linked to a host is checked the moment that host reports a deploy; an app linked to a payment or AI account starts building its baseline from that hour.

Or sign in instead of pasting a key

You can also connect by signing in to Stripe. Your client signs in to Stripe and grants read-only access. Keelnest can read charges, disputes, payouts, events and webhook endpoints, and can never refund, charge or change a price — Stripe enforces that, not us. You can revoke it from your Stripe dashboard at any time.