Skip to content
AskVault Docs
Try Free →

How to connect Stripe to AskVault

Written by Joseph Russo, Principal Architect, Networks and Tech, AskVault · Reviewed by Allison Chan
Last updated: · 4 min read

What this integration unlocks

The Stripe integration powers two skills, both off until you enable them:

  • subscription_manager. Upgrades or downgrades the Stripe subscription of a signed-in customer, identified by the email your site signed with identity verification. Downgrades must match a written policy in your knowledge base; upgrades don't. It also has a refund action. Each action runs only after the visitor confirms in chat (see use cases); refunds are still declined today because the policy check can't yet read a refund ceiling. It doesn't expose a standalone "what plan am I on" status answer.
  • discount_negotiator. Applies a Stripe coupon code to a customer. Its checks: a fixed 15% maximum set by AskVault, plus a written discount policy in your knowledge base that states a ceiling (for example "up to 10%"). Like refunds, it currently declines every request because the policy check can't yet read that ceiling.

Both skills are on the Business plan and above. Business+

Setup, step by step

The integration is OAuth-based. No API key management on your side.

  1. Open Automation > Skills > subscription_manager in AskVault. Click Enable.
  2. Click Connect Stripe. OAuth consent flow opens.
  3. Sign in with your Stripe account. Approve the connection.
  4. You're redirected back to AskVault. Connection shows active. AskVault automatically subscribes to the Stripe webhook events it needs (see Webhooks below): no manual endpoint setup required.
  5. Try a plan change from the chat while signed in to your site with identity verification, as a Stripe customer you control whose email your site signs as the user_id. You can't pick test mode when connecting, so use a customer you'd be comfortable changing: a confirmed change is made on their live subscription. The bot shows a confirm card first. Reply with a short yes within 10 minutes, in the same conversation, and the bot makes the change in Stripe (a downgrade also needs a matching written downgrade policy); AskVault doesn't count a confirmation the AI writes for itself. A refund test is still declined today, because the policy check can't yet read a refund ceiling.

Scopes requested

Stripe Connect's standard OAuth only offers two grant levels, not per-object scopes: AskVault requests read_write, which is what the refund and plan-change actions need to function. There's no separate, narrower "read-only" OAuth mode for this integration today: the safety boundary is AskVault's own layer: subscription_manager is disabled by default, gated to the Business plan, it acts only on an email your site signed with identity verification, refunds and downgrades must match a written policy, and refunds are also held to a daily cap. A plan change also needs the visitor's own yes: AskVault records the confirm card it showed and runs the change only when a later message from the visitor, within 10 minutes of the card, is a short yes for the same request in the same conversation. Most customers should keep the skill disabled and route billing-change requests through escalate_to_human until they've written refund and downgrade policies they're comfortable with.

How the bot resolves a customer

subscription_manager acts only for a visitor signed in with identity verification for whom your server signs the customer's email as the user_id. The email in the request must be that signed email; an email the visitor merely types, or a signed user_id that is not an email, is refused before Stripe is ever called, and the bot is told to offer a teammate instead. There's no email-code verification step.

It then looks the email up in Stripe; if no Stripe customer has that email, it does nothing.

discount_negotiator bounds

The discount_negotiator skill applies the Stripe coupon code the bot proposes to a customer. Its checks:

  • Global maximum. 15%, set by AskVault. Anything above is declined. Not adjustable from the dashboard. Note that both checks compare the percentage the bot states, not the discount configured on the coupon in Stripe: only offer coupon codes whose Stripe value matches your policy.
  • Written policy ceiling. AskVault searches your knowledge base with a fixed phrase about discount policy (not the visitor's words) and uses the top passage only if it scores at least 0.92 similarity. That passage must state a percentage ceiling, such as "up to 10%" or "max 10%". A discount above that ceiling, or a policy with no recognisable ceiling, is declined.

There's no per-visitor cap, no monthly per-workspace cap, no per-code usage cap, and no bounds screen in the dashboard. Today the policy check can't yet read the ceiling, so every discount request is declined.

Webhooks (incoming events from Stripe)

You don't need to configure anything in Stripe Dashboard. When you connect, AskVault automatically registers a webhook endpoint on your Stripe account and subscribes to:

  • customer.subscription.created
  • customer.subscription.updated
  • customer.subscription.deleted
  • invoice.paid
  • invoice.payment_failed
  • checkout.session.completed

Re-running the connect flow doesn't create a duplicate: AskVault reuses its existing endpoint, or deletes and re-creates it if it no longer has that endpoint's signing secret.

When an event names your connected Stripe account, AskVault checks its signature against that signing secret and logs it. An event that doesn't name an account is acknowledged and dropped without a signature check. Nothing else happens with these events today.

Compliance

Mutating actions (refunds, plan changes, coupons) only happen through the subscription_manager and discount_negotiator skills, which are disabled by default. For the connection, AskVault stores the encrypted OAuth token and the encrypted signing secret of the webhook endpoint it creates on your account (it also deletes that endpoint when replacing it). PCI compliance stays with Stripe; we never see card numbers.

There's no dedicated audit-log screen for Stripe lookups or billing actions in the dashboard today.

Limits

  • Stripe API rate limits. Stripe's own rate limits apply to your account.
  • Timeout. Each Stripe API call gives up after 15 seconds.
  • Multi-account. One Stripe account per AskVault workspace. For multi-account use, create separate workspaces.

Common pitfalls

Bot says "I couldn't find your account". The visitor's email doesn't match any Stripe customer record. They may have used a different email at signup. The skill stops there; enable escalate_to_human if you want the bot to be able to hand these to your team.

Every discount is declined. Expected today: see discount_negotiator bounds. Once discounts are enabled, a code can also be rejected by Stripe if it has expired; check Stripe Dashboard > Coupons.

FAQ

Can the bot cancel subscriptions?

No. subscription_manager (Business plan and above) has a downgrade action but no cancel action, and a downgrade runs only after the visitor confirms in chat and your knowledge base holds a matching written policy. If you want cancellation requests handed to your team, enable the escalate_to_human skill. subscription_manager is disabled by default; most customers should leave it off until they've written refund and downgrade policies.

Can the bot create refunds?

Not today. The refund action exists in subscription_manager (Business plan and above, disabled by default), with a daily refund cap and a written policy match enforced outside the model's control: but the policy check currently declines every refund, so none are issued. See use cases.

Does this work with Stripe Connect (platform accounts)?

Each workspace connects one Stripe account through Stripe's OAuth. AskVault acts only on that account's own customers and does not reach a platform's connected accounts.

What about Razorpay or PayPal?

Not yet as a customer-facing skill integration: Stripe is the only payment processor AskVault connects to a workspace today. For Razorpay, PayPal, or other processors, use the custom_webhook skill to call your backend that bridges to the processor.

Is there a sandbox?

No. There's no test-mode connection today. Connecting doesn't ask for your API keys, and you can't choose test mode during the OAuth flow.

Was this page helpful?