SeatLayer takes payments through your own Stripe account using a restricted API key that you paste on the dashboard’s Settings → Payments page. A restricted key grants only the permissions you choose, so SeatLayer never holds more access to your account than it needs. This page lists the four permissions, says why each one is needed, and shows how to create the key.
The four permissions
| Permission | Level | Why SeatLayer needs it |
|---|---|---|
| Checkout Sessions | Write · required | To open Stripe’s payment page for each order. |
| Webhook Endpoints | Write · required | So Stripe can tell us a payment succeeded and we can confirm the seats. |
| Refunds | Write · recommended | To refund from your dashboard and put seats back on sale. |
| Basic Business Contact Information (Account) | Read · recommended | To show which Stripe account is connected and its currency. |
A key missing a required permission is refused when you paste it, and a connected key that loses one shows Connected · cannot take payments yet on the Payments page until it is replaced. A key missing Refunds still takes payments; refunds from the dashboard fail until the scope is granted.
Create a restricted key
- In Stripe, open Developers → API keys → Create restricted key.
- Set Checkout Sessions, Refunds and Webhook Endpoints to Write, and Basic Business Contact Information to Read. Leave every other resource on None.
- Choose the mode:
- Test events: switch Stripe’s Test mode toggle on and create an
rk_test_…key. - Live events: keep Test mode off and create an
rk_live_…key. Test and live are separate keys; a test key serves sandbox events only.
- Test events: switch Stripe’s Test mode toggle on and create an
- Paste the key on Settings → Payments. SeatLayer verifies the permissions, creates its payment webhook on your account, and connects. Pasting a new key replaces the old one without a gap in payments.
The permission checklist
Under a connected Stripe card the Payments page lists the four permissions with Granted or Missing for each, from a real check against Stripe — not from the key’s prefix. A missing row shows Stripe’s own message and what it stops. Re-check permissions runs the check again (at most once a minute); the page never re-checks on its own. Permissions are checked without creating anything in your Stripe account — no session, no booking.
If Stripe rejects the key itself (it was rolled or is no longer valid) the card reads Stripe rejected this key — replace it; use Replace key to paste a new one.
When the key is fine but Stripe still refuses
Sometimes the key has every permission and Stripe refuses the payment call for a setting in your account — for example “the product tax code is missing” when Stripe Tax is on without a default tax code. The card then reads Stripe account needs a change, the row is marked Refused with “Granted, but Stripe refused: …” and Stripe’s own message, and the chip stays cannot take payments yet. Fix the setting in your Stripe dashboard (for a tax message: Settings → Tax → default product tax code), then Re-check permissions. Do not create a new key for this; the key is not the problem.
SeatLayer never displays or returns your key after you paste it: it is sealed server-side and can only be replaced, never read back.