Stripe Service Principals
Service by Stripe
Secure non-human identities for AI agents and automated services.
Stripe Service Principals provides non-human identities for AI agents and applications to securely access Stripe. It replaces long-lived API keys with Workload Identity Federation and short-lived tokens, enabling granular permission control and centralized activity monitoring.
Category: Identity & Access Management
- How to get it
- Online via the Stripe Dashboard and API
- Engagement model
- Included with Stripe Organization (Private Preview)
- Primary Authentication Method
- Workload Identity Federation
- Token Lifespan
- 1 hour
- Supported Cloud Providers
- Google Cloud (Private Preview)
- Management Interface
- Stripe Dashboard & API
- Non-human identities for apps and AI agents
- Workload Identity Federation support
- Short-lived access tokens (1-hour expiry)
- Granular API permission assignments
- Two-party approval rule compatibility
Overview
Stripe Service Principals is a security service that allows businesses to create non-human identities for applications, services, and AI agents accessing Stripe. It solves the risk associated with long-lived API keys by introducing a durable identity that is distinct from its transient authentication method. The service enables Workload Identity Federation, allowing workloads on platforms like Google Cloud to authenticate to Stripe using short-lived tokens that expire after one hour. Administrators can manage these identities through the Stripe Dashboard, assigning granular permissions and monitoring activity even if underlying credentials change. This infrastructure is designed for automated environments where agents require secure, programmatically managed access to financial data. Currently in private preview, it supports advanced governance features like two-party approval rules and access policies.
Identity and Access Management
- Non-human Identity Management: Configure non-human identities to represent applications, services, or AI agents that need to access Stripe resources.
- Granular Permissions Control: Assign specific Stripe API permissions to service principals in the same way human team members or restricted API keys are configured.
- Durable Identity Tracking: Maintain a durable identity for an application that remains consistent even if its transient authentication methods change.
- Activity Monitoring: Monitor the specific activity of a service or agent through the Stripe Dashboard and activity logs.
Security and Authentication
- Workload Identity Federation: Authenticate to the Stripe API from external cloud providers like Google Cloud without using long-lived, static API keys.
- Short-lived Access Tokens: Exchange short-lived identity tokens from cloud providers for Stripe access tokens that expire after 1 hour.
- Governance and Approvals: Apply advanced governance controls such as access policies and two-party approval rules to service principal actions.
- OAuth-based Authentication: Use OAuth client IDs generated by Stripe to request temporary access tokens for specific workloads.
Developer Experience
- Ruby SDK Support: Integrate service principals with the Ruby SDK to handle the creation and exchange of short-lived access tokens.
- Multi-workload Support: Configure multiple subjects for a single service principal if it acts on behalf of multiple workloads.
- Centralized Dashboard Management: Manage service principals centrally through the Organization section of the Stripe Dashboard.
How it works
- Create a service principal in the Dashboard, configure authentication method, assign permissions, copy client ID, exchange tokens for access
Use cases
- AI agents use service principals to securely initiate payments or manage subscriptions without exposing long-lived secret keys.
- Cloud-hosted applications on Google Cloud authenticate to Stripe using Workload Identity Federation to reduce credential theft risk.
- Enterprises apply two-party approval rules to automated service actions to ensure high-stakes financial operations are reviewed.
- Developers monitor the specific API activity of different microservices by assigning each its own unique service principal identity.
Specifications
- How to get it
- Online via the Stripe Dashboard and API
- Engagement model
- Included with Stripe Organization (Private Preview)
- Primary Authentication Method
- Workload Identity Federation
- Token Lifespan
- 1 hour
- Supported Cloud Providers
- Google Cloud (Private Preview)
- Management Interface
- Stripe Dashboard & API
- Identity Type
- Non-human (Service/App/Agent)
- SDK Support (WIF)
- Ruby SDK (Private Preview)
- Permission Model
- Resource-based (Read/Write/None)
How it works
- Create Service Principal: Navigate to the API authentication section in the Stripe Dashboard to create a new service principal and give it a descriptive name.
- Configure Authentication: Select a workload identity provider and provide the Issuer URL and subject that matches the external workload.
- Assign Permissions: Select between common permission templates or assign custom permissions to specific Stripe API resources.
- Exchange Tokens and Authenticate: Use the generated OAuth client ID within your application to exchange cloud identity tokens for short-lived Stripe access tokens.
FAQ
What is the difference between a service principal and a human team member?
A service principal is a non-human identity representing an application, service, or AI agent, whereas a human team member represents an individual person. Service principals use transient authentication methods like Workload Identity Federation instead of passwords or passkeys.
How long do the access tokens last?
Access tokens generated through Workload Identity Federation for service principals expire after 1 hour.
Added by AntSpace from public sources (docs.stripe.com).