Connect Stripe for revenue attribution

A Stripe account with access to the API keys page, and permission to create a restricted key. Not your main secret key; Stripe rejects it here on purpose (see Troubleshooting).

1. 1
   In your Stripe Dashboard, go to Developers → API keys.
2. 2
   Click Create restricted key.
3. 3
   Name it something identifiable, e.g. "thexly-readonly".
4. 4
   Set exactly two permissions, everything else stays at None:

   • Checkout Sessions: Read
   • Webhooks: Write

   That's the complete list Thexly's connection uses: Checkout Sessions to pull in your recent payments on first connect, Webhooks so Thexly can register its own endpoint. It never calls Stripe's Payments, Customers, Subscriptions, Refunds, or Disputes APIs directly.
5. 5
   Click Create key, and complete the two-factor prompt if asked.
6. 6
   Copy the key immediately: Stripe only shows it once. It starts with rk_live_ (or rk_test_ in test mode).
7. 7
   Paste it into Thexly under Settings → Payments → Stripe.

Thexly reads your completed Checkout Sessions and matches them against the sessions your tracking script captured; see how Thexly assigns revenue to a channel for the full mechanism. Going forward, Stripe pushes events to the webhook Thexly registers for you; Thexly doesn't need to keep polling the API. Nothing is ever written back to your Stripe account beyond that one webhook registration, and the key never has write access to payments, customers, or anything else.

If a checkout happens through a static Payment Link, Thexly's tracking script automatically appends the visitor's session to the link before they click it, no code change needed on your side. If you create Checkout Sessions or Payment Intents yourself (server-side), pass the visitor's current session as client_reference_id (or in metadata.thexly_session_id) so the payment can be matched. Call window.thexly.getSessionId() from your checkout page to get it.

• "Invalid API key" on save: you likely pasted a secret key (sk_) or publishable key (pk_) instead of the restricted key. Only rk_ keys are accepted.
• Payments not appearing after connecting: double-check the key has Read on Checkout Sessions. A key saved with the wrong permissions won't error on connection, it'll just return nothing.
• Key stopped working: someone may have rolled or deleted it in the Stripe dashboard. Create a new restricted key with the same two permissions and reconnect.

Once connected, head back to Verify it's working and confirm a test payment shows up in your dashboard.