# Connect your Stripe account

> Make a restricted key in Stripe with exactly the access Travel Orbit needs, paste it in, and know what happens if the key stops working.

Source: https://docs.bifrostorbit.com/travel/everyone/connect-stripe/

Travel Orbit takes payments through your own Stripe account. Travellers pay into your account, Stripe pays out to your bank, and Travel Orbit takes no fee on bookings. Card details go straight from the traveller to Stripe and never reach Travel Orbit.

You give Travel Orbit a restricted key: a key that can only do the things you tick, which you can remove in Stripe at any time. Only Admins can connect, change or remove the key, under **Stripe** in the sidebar. You need to be an administrator of the Stripe account.

## Make a restricted key

1. In the Stripe Dashboard, open **Developers**, then **API keys**. The **Stripe** screen in Travel Orbit has buttons that open your **Live keys** and **Test keys** directly.
2. Select **Create restricted key**. If Stripe asks how you will use the key, choose the option for your own integration, not the one for another website, so you can set the access yourself. Name it Travel Orbit, so you recognise it later.
3. Give it these permissions and leave everything else at **None**. **Copy the list** on the **Stripe** screen copies them for you.

| Resource | Permission | What Travel Orbit uses it for |
| --- | --- | --- |
| Customers | Write | Saves each lead traveller, so later instalments can be taken from the same card. |
| PaymentIntents | Write | Takes deposits, instalments and balances. |
| SetupIntents | Write | Saves a card for later when nothing is due at booking. |
| Refunds | Write | Refunds travellers from Travel Orbit. |
| Disputes | Write | Shows disputed payments on the booking. |
| Webhook endpoints | Write | Lets Stripe tell Travel Orbit when a payment succeeds, fails or is refunded. |
| Charges | Read | Reads payment details to match refunds and disputes. |
| Balance | Read | Reads your Stripe balance for reports. |
| Payouts | Read | Reads payouts to your bank for reports. |

4. Select **Create key** and copy it. It starts with `rk_live_` or `rk_test_`.
5. Copy your publishable key from the same page too. It starts with `pk_live_` or `pk_test_`, and the booking pages use it to show Stripe's payment form.

## Paste it in

On the **Stripe** screen, paste the restricted key under **Secret key** and the publishable key under **Publishable key**, then select **Connect Stripe**. A full secret key, starting with `sk_`, also works, but it can do anything in your account, so a restricted key is safer. Travel Orbit then:

- checks each permission with a harmless request and lists any that are missing
- reads your account's name, country and default currency
- creates a webhook endpoint in your Stripe account, named after your organisation, so Stripe can tell Travel Orbit about payments
- stores the key and the webhook's signing secret encrypted, and never shows the key again

The screen then shows your account, whether it is **Live** or in **Test mode**, and whether it is **Taking payments**. Under **Payment updates** it says whether Stripe can tell Travel Orbit about payments straight away.

If a permission is missing, the screen says which one. Without **PaymentIntents** or **Customers**, nobody can pay online and bookings arrive as requests. Without **Webhook endpoints**, Travel Orbit can't hear about payments straight away, so give it that permission too. To fix the access, edit the key in Stripe, then choose **Use new keys** and paste the keys again.

## Test and live keys

Use test keys first. With `rk_test_` and `pk_test_`, bookings go through as usual but no real money moves, and you can pay with Stripe's test cards, such as `4242 4242 4242 4242`.

When you are ready, choose **Use new keys** and connect your live keys the same way. A live secret key only works with a live publishable key, and a test key with a test key. Bookings made in test mode stay in Travel Orbit; cancel them before you sell for real, so they don't take places on your departures.

## When a payment is missing

If a payment shows as paid in Stripe but not on the booking, open the booking and select **Check with Stripe** under **Payments and refunds**. Travel Orbit also checks by itself when the traveller comes back from paying, and every minute for bookings still waiting for a payment, so this is rarely needed.

## If the key stops working

If someone removes the key in Stripe, or Stripe stops accepting it, Travel Orbit marks the connection as **Not working** when it next tries to take an automatic payment. The **Stripe** screen and the **Overview** say so. Until you connect a working key:

- automatic payments pause, and travellers get reminders to pay instead
- new bookings arrive as requests, without payment, so nobody is charged by mistake
- travellers can't pay from the traveller portal
- card payments can't be refunded, but you can still record payments made outside Stripe

Bookings, travellers and payment records all stay. Choose **Use new keys**, connect a new key and everything carries on.

## Remove the connection

**Disconnect** removes the webhook Travel Orbit made in your Stripe account and forgets the key. Nothing else in Stripe changes: customers, payments and payouts stay where they are. Without a connection, new bookings arrive as requests.