Stripe

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads a Stripe account’s balance and its balance transactions, so finance and support agents can reconcile payouts, fees and refunds against the books. It is read-only, and it refuses a secret key. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse.

At a glance

Collector	Stripe, version 1.0.0
Reads	Stripe: Stripe API (balance, balance transactions) (the vendor's documentation)
Family	Finance
Kind	Payments
Ways to connect	Access token
Scopes	Read: Balance Read
Read only	Yes
Vendor's API can move money	Yes
Personal data	Financial
Hosts it may contact	api.stripe.com, {host}
Vendor API versions	Stripe API v1
Lowest engine version	0.46.0

What it reads

• The balance: the available and pending amounts, one record per currency, rewritten only when it changes and removed when the currency disappears.
• Balance transactions: amount, fee and net, with type, reporting category, status, source and the date the funds become available.
• Balance transactions are read from the last created time, 100 a page, following starting_after. The first read goes back history_days (default 90, at most 3,650).
• Amounts are integers in the currency’s minor unit and are scaled exactly by the currency’s exponent: zero-decimal (such as JPY), two-decimal, and three-decimal (BHD, JOD, KWD, OMR, TND) currencies as Stripe lists them.

It does not read customers, charges, payment methods or payouts’ bank details.

How to connect

1. In Stripe, make a restricted key (rk_live_ or rk_test_) with Read on Balance and nothing else, restricted to your deployment’s egress addresses.
2. In LightHouse, open Setup and admin, Connectors and choose Stripe.
3. Paste the key and confirm it is read-only. Your browser seals it to your deployment; LightHouse never sees it.

The credential is JSON in the variable the source names (AAL_STRIPE by default): api_key and view_only_confirmed (yes).

Permissions

This collector is read-only: it sends GET requests only (/v1/balance and /v1/balance_transactions), and its read-only test proves it on every change.

• Refused by the code: a key that begins sk_ (a secret key, live or test), by its prefix, before it is used and before any request is made. A secret key can do anything the account can. The error is Stripe: refused: the credential can do anything the account can (a secret key; use a restricted key); make a view-only one.
• Not detectable by the code: Stripe does not state a restricted key’s permissions to it. Any key that does not begin sk_ passes the prefix check, including a restricted key that has write permissions. The collector reads only once you have confirmed the key has Read on Balance only (view_only_confirmed); without it the error is Stripe does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read. Make the key read-only in Stripe: that, not this code, is what stops a restricted key from writing.
• Hosts: only api.stripe.com, over https; redirects are never followed.

Limits

• Stripe API v1.
• Requests are paced (0.05 s apart) and retried on 429 and 5xx with back-off.
• The source of a balance transaction is Stripe’s id for what caused the movement; the collector does not look it up.
• Amounts are exact decimals; a number that arrives as a float is refused.

Data handling

• Records hold financial data: balances and balance-transaction amounts. Documents carry the label you give the source (default confidential).
• Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential.
• Errors carry a status and fixed text, never a provider’s body.
• The data is audit-ready for your own agents; nothing here certifies anyone against any regulation.

Troubleshooting

What you see	What it means	What to do
Stripe: refused: the credential can do anything the account can (a secret key; use a restricted key); make a view-only one	The key is a secret key (sk_)	Make a restricted key with Read on Balance only
Stripe does not state this key's permissions; confirm the key is view-only (view_only_confirmed) before it is read	You have not confirmed the key is read-only	Confirm it, after checking the key in Stripe
Stripe answered HTTP 401	The key is wrong or revoked	Make a new restricted key
Stripe answered HTTP 403	The key lacks Read on Balance	Add Read on Balance
Stripe answered HTTP 429	Rate limit	Nothing; the collector backs off and continues

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	Stripe API v1	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only