/
Menu

Provider tokens Solo plan

How to create the least-privilege token for each provider you can connect: Stripe, AWS and Polar.

Create each token so it can only read. StackHangar refuses a token that can do more, and doesn't keep it. The same steps appear on the Add a connection form when you choose the provider. See Connections.

#Stripe

StackHangar reads daily revenue, refunds and fees.

  1. In the Stripe Dashboard, go to Developers, then API keys.
  2. Choose Create restricted key and name it StackHangar.
  3. Set Balance to Read. Leave every other resource on None.
  4. Don't tick Write on anything.
  5. Create the key and copy it. It starts with rk_live_. Paste it into the connection form.

If you don't see a Balance row, look for the permission balance_read. A secret key that starts with sk_ is refused.

#AWS

StackHangar reads daily cost by tag or linked account.

  1. In the AWS IAM console, create a user. Don't turn on console access.
  2. Don't attach any group or managed policy to the user.
  3. Add an inline policy that allows only the action ce:GetCostAndUsage.
  4. Create one access key for the user and copy the key ID and the secret. Paste both, separated by a colon.

Each request costs you $0.01 at AWS. StackHangar reads once a day.

Note

We haven't yet confirmed that this action alone is enough. If the first read fails with a permission error, tell us.

#Polar

StackHangar reads daily revenue for your organization.

  1. In Polar, open Settings, then Access Tokens, for the organization that sells your product.
  2. Create an organization access token and set an expiration date.
  3. Tick only metrics:read. Leave every other permission unticked.
  4. Copy the token once and paste it into the connection form.

Use an organization token, not a personal one. If you don't see metrics:read as a checkbox, the label may differ. Choose the option for reading metrics only.

#Replacing a token

To replace a token, see Rotate a connection's token on the Connections page.