Level 51
Encrypt the data if you really must store their keys. Easiest way would be to write a custom mutator class that encrypts on store and decrypts on get.
Nov 1, 2021
11
Level 6
Storing Stripe Keys in DB.
I created an App (SaaS) where each customer can sell their products, and use their own Stripe credentials/APIs Keys.
What's your view about storing Stripe API keys in the Database? Any recommendations?
Level 6
@lancashireman by the way... I tried this but it did not work. It seems that encrypt has some string length limitation. The Stripe key seems to be too long.
Level 80
@extjac Why are you still trying to save (and encrypt) Stripe keys when I told you yesterday that you don’t need to, and also pointed you to Stripe’s documentation on how you connect an account and then capture payments for a connected account…?
Level 6
@martinbean not an easy switch for me right now. Looking into both options. But yes, I will implement Stripe Connect. I really appreciate your help! I was not even aware that Stripe connect can do that.
Level 80
@extjac So up to now you’ve been asking your customers for their Stripe keys and secrets…?
Level 6
@martinbean Yes. Each customer has its own front-end & EC2 instance, DB, etc; but now I am switching to a SaaS approach because I am starting to growth and I cant scale with the current model.
Level 80
@extjac They‘re called secret keys for a reason 🙂
1 like
Level 2
@extjac You might want to consider WooCommerce model. It asks for Stripe connect account. I agree with @martinbean that it is kind of questionable to store someone else secret keys in your own database.
Level 80
@extjac Use Stripe Connect. You can redirect your customers to Stripe and then they can connect their own Stripe account. In the callback, you can get the Account ID, which you’ll use to specify as the destination account when creating PaymentIntents. You do not need to deal with the other accounts’ API keys at all.
Onboarding docs: https://stripe.com/docs/connect/collect-then-transfer-guide
Level 6
@martinbean ok thanks. Problem is that some customers use two stripe accounts....So i need to store at least two set of keys. but i will look into Stripe Accounts. Thanks.
Level 80
@extjac No, you don’t. It doesn’t matter how many accounts a customer has.
All you need is the account ID, which you get when a customer goes through the account linking process. You can then specify the relevant account ID when creating PaymentIntents in your application.
Please or to participate in this conversation.