> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Stripe in Customer Installs

> Choose the Stripe account arrangement and application behavior for your BYOC product.

> [!NOTE]
>
> Preview guidance. Review the decisions and proposed changes before applying them to your product.

Decide whether Stripe remains part of your customer install. Keeping billing with your business, using a customer's Stripe account, replacing billing and removing it are different product choices. Follow the [external-service decision process](https://docs.tensor9.com/byoc/onboarding/external-services.md) before changing credentials or code.

## Find what your application uses

Trace the actual functions: customer creation, checkout, payment methods, subscriptions, invoices, refunds, customer-portal access and webhook-driven application access. Your application might use only some of these. Inspect signup and organization creation as well as billing screens, jobs and workers.

Record the account-scoped identifiers your application stores or expects, including customer, product, price and subscription references where applicable. A new account key does not recreate these objects or update existing references. If another service sends invoices to Stripe, trace its account and customer mappings too; [Metronome](https://docs.tensor9.com/byoc/onboarding/metronome.md) is one example.

## If you retain Stripe

Choose who owns the Stripe account, who pays for its use, how installs are isolated, and who maintains configuration and handles failures. Customer-owned accounts need a supported setup and migration procedure. Do not assume a different key is the whole procedure.

Stripe separates sandbox and live objects and credentials. Use the intended sandbox for approved integration testing. Server credentials and webhook signing secrets are distinct; store them privately and grant only the permissions the integration needs. Follow Stripe's [API-key guidance](https://docs.stripe.com/keys).

Where your application receives webhooks, configure the actual reachable endpoint and event types it consumes. Validate signatures against the original request body and handle duplicate or unordered events. A delivered callback is not proof that the application applied the intended change. See Stripe's [webhook guide](https://docs.stripe.com/webhooks).

Preserve operation identity when retrying mutating API calls so a timeout does not create duplicate business objects. Stripe documents its [idempotent-request behavior](https://docs.stripe.com/api/idempotent_requests). If subscription events control application access, preserve the intended renewal, failure and cancellation policy; see [subscription webhooks](https://docs.stripe.com/billing/subscriptions/webhooks).

## If you replace or remove Stripe

Agree on the resulting billing and access policy first. Identify every application decision that currently depends on Stripe and its replacement. Include startup, signup, background work, callbacks, user interfaces and stored state in the reviewed change.

Plan fresh-install and upgrade behavior separately. Keep required billing history, handle in-flight work, and remove credentials or unused infrastructure only after their consumers have been removed or migrated. A blank key, a swallowed exception or an unconditional access grant does not implement an agreed product policy.

Tensor9 does not automatically select removal, transfer a Stripe account or rewrite your application billing. The vendor approves the behavior and application change.

## Check the chosen behavior

For retention, exercise a legitimate, approved sandbox flow. Independently read the expected Stripe object and the corresponding application state. Test retry and duplicate-event handling, rejected or invalid callbacks, and the chosen response to provider failure. Do not use a production charge as an incidental test.

For replacement or removal, run native signup and core application operations with Stripe absent, then read back the created application data. Test delayed work, the agreed entitlement policy, and a supported upgrade. Record missing configuration or failed checks as unresolved findings rather than hiding them behind a health response.

The [onboarding skills](https://docs.tensor9.com/byoc/onboarding/agent-skills.md) can help collect evidence and propose a change. A catalog suggestion does not decide it for you.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.