Stripe
Paymentssystem_type: "stripe"Proxy Stripe API calls for payment processing, customer management, and subscription operations.
Overview#
The Stripe connector proxies Stripe REST API v1 calls. Secret keys are sealed in QuantaVault with ML-KEM-768 encryption. Supports charges, payment intents, customers, subscriptions, and webhook event verification.
https://api.quantaseal.io/api/v2/proxy/outboundAuth header:
X-API-Key: qs_live_…Prerequisites#
- 1A Stripe account
- 2A Stripe secret key (sk_live_... or sk_test_...)
- 3A QuantaSeal API key
Configuration#
Follow these steps to connect Stripe to QuantaSeal. You can configure integrations via the Admin Console or directly via the API.
- 1
In Stripe Dashboard → Developers → API Keys, copy the secret key.
- 2
Seal: POST /api/v2/vault/seal with credential_type: api_key.
- 3
Create integration with system_type: stripe.
- 4
For webhook verification, also seal the webhook signing secret as webhook_secret.
Authentication Types#
Seal the Stripe secret key as api_key. Never use the publishable key for server-side calls.
All credential types are sealed in QuantaVault with ML-KEM-768 + AES-256-GCM and wrapped by your tenant AWS KMS CMK before storage. See the Vault API reference for the full list of credential types and seal/unseal endpoints.
Available Operations#
QuantaSeal enforces a default-deny operation policy. Only operations listed in your integration's allowed_operations array will be permitted. Add operations when creating or updating the integration.
| Operation | Description |
|---|---|
create_payment_intent | Create a PaymentIntent for a charge. |
get_customer | Retrieve a Stripe customer by ID. |
create_customer | Create a new Stripe customer. |
list_subscriptions | List active subscriptions. |
create_invoice | Create and send an invoice. |
Code Example#
Every proxy call returns a HybridCryptoEnvelope - the response is ML-KEM-768 key-encapsulated, AES-256-GCM encrypted, and signed with ML-DSA-65 + HMAC-SHA-512. Verify both signatures before trusting the decrypted payload.
curl -X POST https://api.quantaseal.io/api/v2/proxy/outbound \
-H "X-API-Key: qs_live_your_key_here" \
-H "Content-Type: application/json" \
-d '{"integration_id":"int_STRIPE001","operation":"create_payment_intent","payload":{"amount":9900,"currency":"aud","customer":"cus_abc123"}}'client.encryption.decrypt(envelope). Both the ML-DSA-65 signature and the HMAC-SHA-512 signature must pass - QuantaSeal uses a bitwise & check, not short-circuit and.Troubleshooting#
No such customer: 'cus_xxx'
Stripe objects are environment-specific. Ensure you are using a test key with test customers, or a live key with live customers.