01
Create a read-only credential
Create the credential in Stripe with the minimum read scope, paste it into devguard, and the connection is live. The integration page in the product spells out the exact permissions.
With a restricted read-only key, devguard checks your Stripe account's posture: onboarding complete, payouts provisioned, and webhooks delivered only over HTTPS.
4 read-only checks, run on a schedule. Each failure becomes a finding linked to a control — every check is listed, none are “coming soon”.
Connectivity check: confirms the secret key authenticates to Stripe and reads the account object (HTTP 200). A non-200 (e.g. 401) indicates an invalid or revoked key.
account-connectivity
Fails if the Stripe account is not fully onboarded — either charges are not enabled or account details have not been submitted. Confirms the key reaches a real, chargeable account.
account-onboarded
Fails if the Stripe account cannot receive payouts (`payouts_enabled` is not true), meaning the money-out path is not provisioned.
payouts-enabled
Fails if any Stripe webhook endpoint delivers events over a non-HTTPS URL. Reads up to 100 endpoints in a single page (Stripe list pagination is cursor-by-last-object-id, which the check DSL cannot express); accounts with more than 100 webhook endpoints are not fully covered. Passes vacuously when there are no webhook endpoints, which is safe — no plaintext delivery exists.
webhook-endpoints-https
Bring your current platform's test list — we'll map it against these checks, gap by gap
Setup is minutes, not a migration project — and every step stays on your side
Create the credential in Stripe with the minimum read scope, paste it into devguard, and the connection is live. The integration page in the product spells out the exact permissions.
The first run starts right after connecting, then repeats on a schedule. Results are timestamped, so your evidence has a history, not a snapshot.
Passing results attach as evidence to the controls they support; failures become findings you triage. When the audit comes, the proof is already connected.
Open any page for its full check register.
You create and scope every credential yourself, and you can revoke it at any time. Checks only read; results and evidence are stored in Switzerland and stay exportable.
Yes. The checks authenticate with a credential you create and scope yourself, and only ever read configuration. devguard holds no write access to Stripe and remediates nothing silently.
A failed check becomes a finding linked to the control it supports, with the evidence attached. You decide the treatment — nothing pages your engineers and nothing is auto-remediated.
Checks run from Swiss infrastructure, and results and evidence are stored in Switzerland. Everything is exportable — your evidence stays yours.
Yes, and you should: create a restricted key with read permissions on account, webhooks and payouts. devguard never needs write access to your Stripe account.
20 minutes on how you run certification today. Bring your current test or control list and we'll map it against these checks — honestly, gap by gap.