The Stripe keys

Updated on 2026-08-28

This chapter is not for a hair salon. It describes the Stripe keys screen in the platform panel: where you set what HairConnect uses to collect the monthly subscription from a salon.

The Stripe screen next to it answers a different question — is it running? This screen answers what is configured?

There are two things called "Stripe"

Do not confuse them; they have nothing to do with each other.

If the money goes to the salon, you are in the wrong chapter.

Where do I find it?

At /platform, in the sidebar under Stripe keys. Only a platform administrator gets in there.

What you fill in

The keys are stored encrypted and never come back on screen — not even for you. What you see again is that there is a key, where it comes from, its last four characters, and the date it was set.

So the fields are empty when you open this page, even when there are in fact keys. That is not a bug: leaving a field empty means "leave what is there". Anyone who pasted the wrong key simply pastes the right one over it.

The safe order

1. Paste the secret key and save.
2. Press Test connection. That is allowed with the integration still off — it only reads: which Stripe account this key belongs to, whether it is open for charges, and whether it is the live or the test environment. Nothing is created and nothing is charged.
3. Only then switch Integration on and save again.

That way a key you merely wanted to try out can never start collecting on its own.

The webhook endpoint

At the bottom of the What is active now block is the address that has to be configured at Stripe. Copy it into the Stripe dashboard, create the endpoint there, and paste the secret you get with it into the Webhook secret field.

Which events to enable on that endpoint is covered in the Stripe chapter.

Two sources, one order

The keys can come from two places:

1. This screen. Stored encrypted. Always wins.
2. .env on the server — STRIPE_PLATFORM_SECRET and STRIPE_PLATFORM_WEBHOOK_SECRET. The old way. Keeps working for anyone who had already set them.

The What is active now block states, for each key, which of the two is being used. That is there on purpose: without it, anyone pasting a new key here while an old one still sits in .env would go blind looking for the reason their new key does nothing.

Deleting a key from .env is not possible from this screen — that is a line on the server. You can override it by setting a key here.

The master switch, and why it has three states

The switch is on or off, but as long as you have never touched it, it is neither: then the situation from before this screen existed applies. Concretely:

• if you had keys in .env, collection simply continues;
• if you had not, nothing happens, not even after you paste a key here.

That last part is intentional: pasting is not yet switching on. From the moment you save once, a choice has been made and the switch is the only answer.

What happens when nothing is configured

Nothing is collected from any salon. Nothing is created at Stripe and no payment comes in. That is not a half state: the calendar, the till and the booking page simply keep running.

On the production server it is different. There the integration refuses loudly as soon as someone tries to activate a subscription. Silently doing nothing is the most expensive mistake there is: it looks fine for months while nothing is collected anywhere, and half a year of uncollected subscriptions cannot simply be charged after the fact.

What this screen does not do

It does not create invoices. The invoice number and the VAT treatment come from the invoicing service; Stripe only collects the amount. And it has nothing to do with a salon's till, the till journal, or the links to an accounting package. That is a different layer.