> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withgale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Gale on Stripe

> Save the restricted key Gale uses to write a Pay with FSA/HSA payment back to your Stripe account.

**Gale on Stripe** is in the Gale Merchant Dashboard under **Integrations → Gale on Stripe**. The one-time Payment Element setup saves its restricted key here. Gale authenticates to your Stripe account with that key and writes the payment record. Save the key before you take a test payment.

The page is per mode. Sandbox and production keep separate credentials, and a test key cannot be saved into production.

> [!NOTE]
>
> Create the `cpmt_…` id on the [Payment Element](https://docs.withgale.com/custom-payment-methods/elements-payment-intent.md#step-1-create-your-custom-payment-method) page and paste it here. Leave the endpoint URL blank on that path. The [Checkout Session](https://docs.withgale.com/custom-payment-methods/elements-checkout-session.md) path is the one that sets the endpoint URL and the signing secret.

## Credentials

| Field | What to paste | Required |
| - | - | - |
| **Restricted API key** | The `rk_…` key Stripe showed you. Not your secret key. | Required the first time you save. Leave the field blank to keep the key already stored. |
| **Custom payment method type ID** | The `cpmt_…` id from the Payment Element page | Paste it for the Payment Element setup. Leave the field blank to keep the saved id. |
| **Signing secret** | Leave blank for the Payment Element | The Checkout Session path needs this secret. Leave the field blank to keep a secret already stored. |

Gale checks the key when you save. Payment Records read and write have to be granted, or the page will not save. Other permissions can be missing: the page warns, and the save still goes through.

## Create the restricted key

Create one restricted key per Stripe account, per mode.

> [!NOTE]
>
> Use a restricted key, not your secret key. The restricted key cannot move money.

**1. Open API keys**

In the Stripe Dashboard, open **Developers** and choose **API keys**.

![Stripe Developers menu listing Workbench, Documentation, and API keys](https://mintcdn.com/galepaymentsinc/xCMsVFbcovX9wrtB/images/stripe-cpm-key-1-developers.png?fit=max\&auto=format\&n=xCMsVFbcovX9wrtB\&q=85\&s=7cdd9500b28b8f2e2bde99adcd7935a8)

Developers → API keys

**2. Create a restricted key**

Find the **Restricted keys** card and click **Create restricted key**. Not the standard secret key above it.

![Restricted keys card with the Create restricted key button](https://mintcdn.com/galepaymentsinc/xCMsVFbcovX9wrtB/images/stripe-cpm-key-2-restricted-keys.png?fit=max\&auto=format\&n=xCMsVFbcovX9wrtB\&q=85\&s=e7bda58f365e092086e1bf9538901fb3)

Restricted keys → Create restricted key

**3. Choose how the key will be used**

Pick **Powering an integration you built** and click **Continue**.

![Create a restricted key dialog with three usage options](https://mintcdn.com/galepaymentsinc/xCMsVFbcovX9wrtB/images/stripe-cpm-key-3-usage.png?fit=max\&auto=format\&n=xCMsVFbcovX9wrtB\&q=85\&s=901ca5cd1ebe64c0ebe01ca37dccbd89)

Create a restricted key, usage

> [!NOTE]
>
> "Providing this key to a third-party application" leads to a different flow. Use the first option.

**4. Grant Payment Records**

Set **Payment Records** to **Write**. Stripe's Write level includes Read, and the Gale page requires both. Without them, save fails.

Leave Checkout Sessions, Products, Prices, Payment Methods, Subscriptions, and Webhook Endpoints at **None**. If one of those is missing, the page shows a warning and still saves.

For [Stripe Billing subscriptions](https://docs.withgale.com/custom-payment-methods/stripe-billing.md), also set **Invoices** to **Write**. Gale uses it to attach each payment to its invoice.

![Create restricted API key page listing resources with None, Read and Write toggles](https://mintcdn.com/galepaymentsinc/xCMsVFbcovX9wrtB/images/stripe-cpm-key-4-resources.png?fit=max\&auto=format\&n=xCMsVFbcovX9wrtB\&q=85\&s=ed06003da75a7174988e5eda64250e3f)

The resource list, all permissions at None

> [!WARNING]
>
> Set the level on the **child row**, not the section header. Setting the section grants far more than this page checks.

**5. Name it and create it**

Give the key a name that will still make sense in a year, such as `Gale HSA/FSA`. Then click **Create key** and copy what Stripe shows you.

> [!WARNING]
>
> Stripe shows a restricted key once. If you leave the page before copying it, create another. Permissions cannot be edited after the key exists, so a missed Payment Records grant also means a new key.

Paste the key into **Restricted API key** and save. On the Payment Element path, leave the signing secret blank.

## After you save

The panel lists each permission as granted, missing, or a warning.

* **Payment Records read and write** are required. If either is missing, the page will not save.
* The other rows are warnings. A warning does not block the save.
* **Signing secret** shows whether one is stored. The value is never shown again. For the Payment Element path, leave it unset.
* **Re-check permissions** runs the check again. Stripe will not show the restricted key a second time, so saving the form again does not refresh the check.

## Which payments are written to Stripe

Gale writes a payment record for a payment whose request carries this in `metadata`:

```json theme={null}
{
  "metadata": {
    "payment_source": "stripe_elements_cpm"
  }
}
```

Send it on the checkout you create for the [Payment Element](https://docs.withgale.com/custom-payment-methods/elements-payment-intent.md), and on each later charge of a [stored card](https://docs.withgale.com/integration/saved-payment-methods.md). On the Payment Element setup, a payment without it is not written to Stripe.

## Related

* [Stripe Payment Element](https://docs.withgale.com/custom-payment-methods/elements-payment-intent.md)
* [Saved Payment Methods](https://docs.withgale.com/integration/saved-payment-methods.md)
* [Webhooks](https://docs.withgale.com/developer-manual/webhooks.md)
* [Create a refund](https://docs.withgale.com/api-reference/endpoint/create-refund.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.