Connect Stripe to FlowMRR: access, permissions and webhooks
Choose a method, limit permissions and verify synchronisation.
Content reviewed:
FlowMRR uses Stripe data for recurring-revenue metrics and payment recovery. Connect with Stripe (OAuth) or provide an API key. This guide explains permissions, webhook configuration and how to verify synchronisation without confusing access granted with successful processing.
Before you start
A FlowMRR account and permission to authorise access to the intended Stripe account.
A decision on read-only analytics versus authorised manual payment retries.
A secure place to manage credentials and matching test or live environments.
Scope
Connection configuration and verification, not a custom Stripe billing integration. Manual live invoice retries may collect real payments; no charge is required to complete this guide.
Step 1
Choose your connection method
'Connect with Stripe' redirects you to Stripe to authorise FlowMRR and provide a revocable access token. Events use the platform's Connect endpoint. An API key lets you choose resource permissions but requires credential management and an account webhook for event delivery. Both paths support analytics when the required data is readable; verify the first sync and event delivery after connecting.
Tip
OAuth offers a guided connection; a restricted API key suits teams that want resource-level control.
Step 2
What 'Connect with Stripe' grants — and why it says read-write
FlowMRR requests read_write for its Stripe Connect OAuth integration. This describes our requested scope, not a claim that Stripe has never offered read_only. FlowMRR reads billing resources for analytics. When you click 'Retry payment', Invoice.pay attempts collection of an existing failed invoice and may charge the customer. On the API-key path, Webhook Endpoints: Write also permits creating or deleting FlowMRR's own webhook. FlowMRR does not change your prices, subscriptions or customer records.
Watch out
The Stripe consent screen will say FlowMRR can 'manage' your account. That is Stripe's generic wording for the read_write scope; our actual behaviour is described above and in our data commitments page.
Step 3
Building a restricted API key (recommended for the key path)
In Stripe's API keys settings, create a restricted API key named FlowMRR. Grant the required Read permissions for Customers, Subscriptions, Invoices, Products, Prices, Coupons, Charges, Refunds, Disputes, Payment Intents, Payment Methods, Balance and Balance transactions. Prefer resource-specific permissions over broad groups. Add Invoices: Write only if you want manual payment retries, and Webhook Endpoints: Write only if you want FlowMRR to manage its own webhook. Keep the key secret and paste it into FlowMRR, not into a public page or support message.
Tip
To rotate a key, create and save the replacement in Settings → Stripe, verify access and synchronisation, then revoke the old key in Stripe.
Step 4
Using a read-only key: what you give up
A read-only key supports analytics if it has sufficient read permissions for the required resources. 'Retry payment' requires Invoices: Write; automatic webhook registration requires Webhook Endpoints: Write. Without a configured webhook, updates rely on scheduled sync rather than event delivery. Check the last sync and any permission errors; do not assume that read-only alone guarantees complete data. You can register a webhook manually without granting endpoint management to FlowMRR.
Step 5
Registering the webhook manually
Open FlowMRR → Settings → Stripe and use 'Register the webhook manually' to obtain the URL and exact event list. In Stripe Workbench → Webhooks → Create event destination, paste that URL, choose snapshot event payloads and select exactly the events currently shown by FlowMRR. Save the signing secret starting with whsec_ in FlowMRR, optionally with the endpoint ID, then save the configuration. A configured webhook status is not proof of successful delivery or processing: verify both separately.
Use FlowMRR's displayed event list rather than wildcard examples or 'all events'. Treat the signing secret as a credential and ensure test or live mode matches the connection.
Step 6
Verifying everything works
Review connection mode, webhook configuration and the last sync in Settings → Stripe. Run the initial sync and inspect completion or errors; duration depends on account volume. Verify a relevant event's delivery in Stripe and the resulting data in FlowMRR. A configuration badge alone proves neither processing nor instant updates. Use a live credential for live-account data and test credentials only for testing.
Step 7
Pausing, revoking and deleting
Use the connection controls to pause synchronisation, 'Remove credentials' to remove stored access, and the available erase-data option to remove derived synced data. For API-key connections, webhook cleanup concerns FlowMRR's own endpoint and requires the relevant permission. Revoke OAuth access or the API key in Stripe when ending access. Consult the data commitments for retention and account deletion; removing FlowMRR data does not imply deletion of a Stripe customer record.
Choose OAuth for a guided connection or a restricted key for resource-level control. Understand the two write boundaries: management of FlowMRR's own webhook when authorised, and a manual invoice retry that may collect payment. Verify synchronisation after setup.
Can FlowMRR charge my customers or change my prices?+
A manual 'Retry payment' uses Invoice.pay on an existing failed invoice and may charge the customer. FlowMRR does not change prices, subscriptions or customer records. With Webhook Endpoints: Write on the API-key path, it can create or delete its own webhook; do not confuse that management with read-only access.
Where are my credentials stored?+
Credentials are encrypted at rest and used server-side for authorised Stripe access. Use Settings to remove stored credentials and revoke access in Stripe as appropriate. Consult the data commitments for current hosting and retention details; never include a key in public content.
Does the read_write scope give FlowMRR access to my Stripe balance or payouts?+
We read your balance to show cash on hand in the Treasury view; we never move money, request payouts or touch bank details. Payout initiation isn't something FlowMRR calls, regardless of the scope Stripe grants.
