Important Stripe Plugin Configuration Update

The latest Stripe plugin connects to your Stripe account with a dedicated restricted API key and verifies every webhook with a webhook signing secret. Update the Stripe configuration in aMember CP to keep payments, refunds and renewals working.

What to change

Open Configuration → Setup/Configuration → Stripe in aMember CP and check these fields:

Field	What it should contain
Publishable Key	Your Stripe publishable key, pk_live_...
Restricted API Key	A restricted key created for aMember, rk_live_.... Replace an sk_live_... secret key with a restricted key.
Webhook Signing Secret	The signing secret of the aMember webhook, whsec_.... If this field is empty, aMember rejects all notifications from Stripe.

Older aMember versions label the Restricted API Key field Secret API Key. It accepts the restricted rk_... key.

Create the restricted key

Follow step 3 of the Stripe setup guide. The guide has a prefilled link that opens the Stripe form with the right permissions already selected. Paste the new key into Restricted API Key and save.

Add the webhook signing secret

If your aMember webhook already exists in Stripe, open Workbench → Webhooks in the Stripe Dashboard, click the destination with the URL https://example.com/amember/payment/stripe/ipn and copy its Signing secret. Also check that it listens to all the events listed in step 4 of the guide.

If there is no such webhook yet, create it as described in steps 4 and 5.

Paste the secret into Webhook Signing Secret and save the configuration.

If Stripe shows the old key as disabled

A disabled, expired, or deleted key cannot be used again. Create a new restricted key and replace the saved key in aMember CP as described above. Then make a test purchase. If Stripe reports a missing permission, edit the restricted key, give Write permission to the resource named in the error, and test again.

For additional details, see Stripe's documentation for API keys, restricted API keys and webhooks.