Skip to main content
Gale on Stripe is in the Gale Merchant Dashboard under Integrations → Gale on Stripe. The one-time Payment Element setup saves its restricted key here. Gale authenticates to your Stripe account with that key and writes the payment record. Save the key before you take a test payment. The page is per mode. Sandbox and production keep separate credentials, and a test key cannot be saved into production.
Create the cpmt_… id on the Payment Element page and paste it here. Leave the endpoint URL blank on that path. The Checkout Session path is the one that sets the endpoint URL and the signing secret.

​
Credentials

Gale checks the key when you save. Payment Records read and write have to be granted, or the page will not save. Other permissions can be missing: the page warns, and the save still goes through.

​
Create the restricted key

Create one restricted key per Stripe account, per mode.
Use a restricted key, not your secret key. The restricted key cannot move money.
1

Open API keys

In the Stripe Dashboard, open Developers and choose API keys.
Stripe Developers menu listing Workbench, Documentation, and API keys

Developers → API keys

2

Create a restricted key

Find the Restricted keys card and click Create restricted key. Not the standard secret key above it.
Restricted keys card with the Create restricted key button

Restricted keys → Create restricted key

3

Choose how the key will be used

Pick Powering an integration you built and click Continue.
Create a restricted key dialog with three usage options

Create a restricted key, usage

“Providing this key to a third-party application” leads to a different flow. Use the first option.
4

Grant Payment Records

Set Payment Records to Write. Stripe’s Write level includes Read, and the Gale page requires both. Without them, save fails.Leave Checkout Sessions, Products, Prices, Payment Methods, Subscriptions, and Webhook Endpoints at None. If one of those is missing, the page shows a warning and still saves.
Create restricted API key page listing resources with None, Read and Write toggles

The resource list, all permissions at None

Set the level on the child row, not the section header. Setting the section grants far more than this page checks.
5

Name it and create it

Give the key a name that will still make sense in a year, such as Gale HSA/FSA. Then click Create key and copy what Stripe shows you.
Stripe shows a restricted key once. If you leave the page before copying it, create another. Permissions cannot be edited after the key exists, so a missed Payment Records grant also means a new key.
Paste the key into Restricted API key and save. On the Payment Element path, leave the signing secret blank.

​
After you save

The panel lists each permission as granted, missing, or a warning.
  • Payment Records read and write are required. If either is missing, the page will not save.
  • The other rows are warnings. A warning does not block the save.
  • Signing secret shows whether one is stored. The value is never shown again. For the Payment Element path, leave it unset.
  • Re-check permissions runs the check again. Stripe will not show the restricted key a second time, so saving the form again does not refresh the check.