Home / Documentation / Integrations

doc://integracoes/stripe

Stripe: connect your account without sending a single key

If you've integrated a payment gateway before, you expect the usual ritual: copy two keys and paste them into the system. With Stripe on MMNWEB, that's not how it works — you authorize the platform to charge on your account, and we store only its identifier. None of your keys ever leaves its place.

Stripe's credential types (and who owns each one)

CredentialPrefixCan it be exposed?Whose is it, on MMNWEB
Publishable keypk_Yes — the only one safe outside the backendPlatform (Fragasoft)
Secret keysk_No. Equivalent to the account's username + passwordPlatform (Fragasoft)
Restricted keyrk_No — same care as the secret keyPlatform (Fragasoft)
Webhook secretNo. Not an API key — it validates that the event came from StripePlatform (Fragasoft)
Connect Client IDca_Identifies the platform in OAuthPlatform (Fragasoft)
Connected account IDacct_Identifier of your accountYours — the only thing we store

There is also the separation between sandbox (test) and production (live): each mode has its own set of keys, and an object created in one mode doesn't exist in the other — the classic "the code is broken" that is actually mixed modes.

Rule of thumb: nothing that starts with sk_ or rk_ leaves the server. Never by email, WhatsApp, ticket, screenshot, or repository. If it has already happened, rotate the key immediately in the Stripe dashboard.

Why you never hand over any key

MMNWEB uses Stripe Connect, Standard type: the Stripe account is yours, complete and independent — your own dashboard, your own reports, a direct relationship with Stripe. You are the merchant of record: disputes (chargebacks), fraud, and negative balances are your responsibility, not Fragasoft's — a deliberate choice: we don't want to carry third-party risk, and you don't want an intermediary making decisions about your sale.

To charge on your account, the platform uses its own secret key (not yours) combined with your account's acct_…. That's why there is no technical reason for you to hand us any key — the acct_… identifies; it doesn't authorize withdrawals.

How to connect, step by step

  1. In the MMNWEB panel, go to your project's payments configuration.
  2. Click "Connect my Stripe account".
  3. You are taken to the Stripe website. Log in (or create an account) and authorize the platform's access.
  4. Stripe sends you back to MMNWEB and the account identifier (acct_…) is saved automatically.
  5. Check the status: the payment method only appears at checkout when the account is ready (see the section below).

At no step do you type or paste a key. Before connecting, complete the Stripe onboarding (company details, bank details, identity verification) — that's where almost everyone gets stuck, and the reason is in the next section.

⚠️ "I connected, but the system says I can't sell"

Having an acct_… does not mean the account can receive money. Stripe controls two separate capabilities: active charging (charges_enabled) and active transfers. An account with incomplete onboarding has a valid acct_… and still gets no payouts — the sale would fail silently or the money would get stuck.

No ready provider, no sale. The checkout only enables Stripe when your account has charging and transfers truly active — verified with Stripe itself, not inferred from the existence of the acct_…. Until then, the button doesn't appear. If you're blocked: go back to the Stripe dashboard and complete whatever it asks for; as soon as it clears, MMNWEB updates on its own.

How the split works

Fragasoft defines a fee percentage for your project (contractual — you don't edit it). At charge time, the percentage becomes an absolute amount in cents sent as the application fee (application_fee_amount) — no percentage is sent to Stripe. Stripe splits it automatically: the net amount goes to your account, the fee goes to the platform. Nothing passes through Fragasoft's account — which is what keeps the operation outside third-party fund custody requirements.

Revoking access

You can revoke the authorization at any time. With a Standard account, you keep full access to your account, dashboard, and data — what you lose is the platform's ability to charge on your behalf. Revoking stops sales through MMNWEB; it doesn't block your Stripe account.

Quick questions

Do I need to send my secret key to support? No. Never. If anyone asks for it, be suspicious — we don't need it and we don't store it.

I tested in sandbox and it worked; in production it failed. They are separate universes. Confirm that the connected account is the production one and that its onboarding is complete.

Can I use PIX through Stripe? For PIX with split, MMNWEB's production path is Mercado Pago.

Official sources

Key types · Secret key best practices · Connect OAuth reference

Related: Integrations overview · Mercado Pago (PIX) · Cielo

Want to see the split checkout in action?