Stripe

The Stripe plugin accepts credit cards and other Stripe payment methods on your aMember signup and renewal pages. Recurring payments are handled by aMember: it saves the customer's payment method in Stripe and charges it when the next payment is due.

To connect aMember PRO to Stripe, you copy three values from the Stripe Dashboard into aMember CP:

aMember CP field	Value from Stripe	Starts with
Publishable Key	Publishable key from the API keys page	pk_live_
Restricted API Key	A restricted key you create for aMember	rk_live_
Webhook Signing Secret	Signing secret of the webhook you create for aMember	whsec_

The steps below take about 10 minutes.

Before you start: live mode and sandbox

Stripe keeps live mode and sandboxes (test mode) completely separate. Keys and webhooks created in a sandbox start with pk_test_, rk_test_ and work only with test cards. Keys from live mode start with pk_live_, rk_live_ and charge real cards.

• To test the integration first, select your sandbox in the Stripe account menu (top left of the Dashboard) and follow the steps below. Stripe shows the You're testing in a sandbox banner at the top of every page.
• For your production site, switch to live mode and follow the steps again. Sandbox keys and webhooks do not work in live mode, and the other way round.

The screenshots below were taken in a sandbox, so they show test keys.

Step 1. Enable the Stripe plugin in aMember

1. In aMember CP, open Configuration → Add-ons.

2. Click the Payment tab and type stripe into the filter box.

3. On the Stripe card, click Activate. When the plugin is active, the card shows an ACTIVE label and a gear icon.

   

4. Click the gear icon, or open Configuration → Setup/Configuration → Stripe. Keep this page open in a browser tab: you paste the Stripe values into it in the next steps.

Note: Use the Stripe plugin, not Stripe (Managed Payments). Managed Payments is a different integration, described in its own plugin documentation.

Step 2. Copy the publishable key

1. Sign in to the Stripe Dashboard and make sure the account and mode (live or sandbox) are the ones you want to use.

2. Open the API keys page (Developers → API keys).

3. In Standard keys, copy the Publishable key token.

   

4. In aMember CP, paste it into Publishable Key.

Do not use the standard Secret key (sk_...): it gives full access to your Stripe account. aMember needs only the restricted key you create in the next step.

Step 3. Create a restricted API key

A restricted key lets aMember do only what it needs: create customers, charge saved payment methods and process refunds. Your other Stripe data stays out of reach.

Quick way: use the prefilled link

Open this link while you are signed in to Stripe: create restricted key for aMember PRO.

Stripe opens the Create restricted API key form with the key name aMember PRO and Write permission already set for the seven resources aMember needs (listed below). Check that Stripe is in the right mode, scroll to the bottom of the form and continue with step 5 below.

Manual way

1. On the API keys page, in Restricted keys, click Create restricted key.

2. Stripe asks how you will use the key. Select Providing this key to a third-party application and click Continue.

   

3. Enter a Name such as aMember PRO and the URL of your aMember installation, for example https://example.com/amember. Tick Customize permissions for this key and click Continue.

   

4. Stripe shows the full list of resources and preselects the ones that third-party applications commonly use. Set Write for these resources and set every other resource to None:

   Stripe resource	Permission
   Charges and Refunds	Write
   Customers	Write
   Payment Disputes	Write
   Payment Intents	Write
   Payment Methods	Write
   Setup Intents	Write
   Checkout Sessions	Write

   Use the Filter resources box to find a resource quickly.

   

5. At the bottom of the form, click Create key and complete Stripe's verification prompt.

6. Stripe shows the new key. Copy the rk_... value right away: Stripe shows a live key in full only once.

7. In aMember CP, paste it into Restricted API Key.

Note: Older aMember versions label this field Secret API Key. It accepts the restricted key too; paste the rk_... value there.

Step 4. Create a webhook for aMember

Stripe uses a webhook to tell aMember about payments, refunds and disputes, including the ones that do not happen in the customer's browser. Without a webhook, aMember does not learn about refunds made in Stripe or delayed bank payments.

The webhook endpoint URL of your aMember installation is:

https://example.com/amember/payment/stripe/ipn

Replace https://example.com/amember with the URL of your aMember installation.

Quick way: use the prefilled link

Open add webhook destination with aMember events. Stripe opens the Create an event destination form with all six events below already selected. Continue with step 4 of the manual way.

Manual way

1. In the Stripe Dashboard, open Workbench → Webhooks (direct link) and click Add destination.

   

2. Leave Your account selected in Event destination scope and Snapshot in Payload style. Keep the default API version.

3. In Events, use the search box to find and tick these events:

   Event	Why aMember needs it
   charge.succeeded	Records successful payments
   charge.refunded	Records refunds made in the Stripe Dashboard
   charge.pending	Delayed payment methods (SEPA Direct Debit, Canadian pre-authorized debit)
   charge.failed	Failed delayed payments
   checkout.session.completed	Required if you enable Use Stripe Checkout
   radar.early_fraud_warning.created	Optional, needed for Refund Transaction on Early Fraud Warning

4. Click the Selected events tab to check your selection, then click Continue.

   

5. Select Webhook endpoint as the destination type and click Continue.

6. Enter a Destination name such as aMember PRO and paste your webhook URL into Endpoint URL. Click Create destination.

   

Step 5. Copy the webhook signing secret

Stripe signs every webhook it sends. aMember checks the signature to make sure the notification really comes from Stripe and rejects every notification if the signing secret is not set.

1. Stripe opens the details page of the new destination. You can return to it later from Workbench → Webhooks.

2. In Signing secret, click the eye icon to reveal the secret and copy the whsec_... value.

   

3. In aMember CP, paste it into Webhook Signing Secret.

Each webhook destination has its own signing secret, and sandbox and live destinations have different secrets. If you create a new destination, copy its secret into aMember again.

Step 6. Save the configuration in aMember

All three fields are now filled in:

Review the optional settings under Extra Settings (described below) and click Save.

Step 7. Test a payment

1. Make sure Stripe is in a sandbox and aMember uses its test keys.
2. Sign up for a product on your aMember signup page and pay with the Stripe test card 4242 4242 4242 4242, any future expiration date and any CVC.
3. In aMember CP, open the user's account: the payment and the active subscription should be there.
4. In Stripe, open Workbench → Webhooks, click the aMember destination and open the Event deliveries tab. Deliveries to aMember should show status 200.

When the test works, switch Stripe to live mode and repeat steps 2–5 to get the live publishable key, a live restricted key and a live webhook signing secret. Replace the test values in aMember CP and save.

Extra settings

Expand Extra Settings at the bottom of the Stripe configuration page in aMember CP to see these options:

Setting	What it does
Disable Automatic Payment Methods	Shows the card payment form only. When unchecked, Stripe also offers the other payment methods enabled in your Stripe Dashboard.
Refund Transaction on Early Fraud Warning	Refunds a payment when Stripe Radar sends an early fraud warning, before the cardholder files a dispute, and cancels the recurring subscription. Requires the radar.early_fraud_warning.created webhook event.
Statement Descriptor Suffix	Text added to the descriptor on the customer's card statement. Card payments only.
Use Stripe Checkout to collect Payment information	Redirects the customer to a Stripe-hosted page for the first payment. aMember still charges recurring payments. Requires the checkout.session.completed webhook event.
Support RBI e-mandates	Required for recurring card payments from India.
Ask for shipping and billing address	Required for international payments to Stripe accounts in India.
Activate Delayed Payments Immediately	For bank payment methods such as SEPA Direct Debit, which take several days to complete: aMember grants access as soon as Stripe reports the payment as pending.
Enable Pre-Authorized Debit (Canada / ACSS)	Accepts payments from Canadian bank accounts, in CAD or USD only. Settlement takes up to 5 business days; also enable Activate Delayed Payments Immediately.
ACSS Debit Payment Schedule, ACSS Debit Transaction Type	Mandate options for Canadian pre-authorized debit.
Theme	Look of the Stripe payment form on the aMember page.

Troubleshooting

aMember shows "Webhook Signing Secret is not configured, all notifications will be rejected". Complete steps 4 and 5 and save the configuration.

Webhook deliveries fail with status 400 and "Invalid webhook signature". The signing secret in aMember does not belong to this destination, for example a sandbox secret is used with a live destination. Copy the secret again from the destination that sends the events. In live mode Stripe retries failed deliveries for up to three days, so the missed events reach aMember after you fix the secret.

A payment fails with a Stripe error about a missing permission. Open the API keys page, click the aMember restricted key, give Write permission to the resource named in the error and test again. Payment errors are logged in aMember CP under Utilities → Logs → Invoice.

The restricted key was disabled, expired or deleted. A disabled key cannot be used again. Create a new restricted key as described in step 3, paste it into aMember CP and save.

See Stripe's documentation for more information about API keys, restricted API keys and webhooks.