News for hackers. Stuff that matters.

A comment on Show HN: A low-code alternative for Stripe/Twilio Integrations. Parent comment

Re:Show HN: A low-code alternative for Stripe/Twilio Integra... by todsacerdoti on Monday January 18, 2021 @12:52PM (#25824425)
I disagree with argument that any integration platform that requests your Stripe keys is a "ruse to harvest api secrets." At Pipedream, our Stripe integration requires the user to authenticate using their keys as well - https://pipedream.com/apps/stripe
[ Parent | on HN ]
Re:Show HN: A low-code alternative for Stripe/Twilio Integra... by hundchenkatze on Monday January 18, 2021 @01:03PM (#25824574)
Okay, Why can't you use the Stripe Connect[0] oauth api? It's generally considered bad practice to ask for and store passwords for other services.

[0] https://stripe.com/docs/connect

[ Parent | on HN ]
Re:Show HN: A low-code alternative for Stripe/Twilio Integra... by yashmaistry on Monday January 18, 2021 @01:24PM (#25824805)
Stripe Connect & OAuth was something we thought about. It's definitely recognised as a more secure method and it's also low friction to integrate. The only drawback comes into play with marketplace and platform apps. The platform itself may already be using OAuth with their customer.

We could offer our customers both options and let them choose which one is best.

[ Parent | on HN ]
Re:Show HN: A low-code alternative for Stripe/Twilio Integra... by jamiesonbecker on Monday January 18, 2021 @01:09PM (#25824648)
Stripe has dedicated application API keys for precisely this purpose. You are likely doing it wrong.
[ Parent | on HN ]