Connecting Stripe to n8n: API key, node, trigger and webhooks (complete guide)

Stripe collects your payments, but it doesn't notify your accountant, update your CRM, or send a welcome email to your new subscriber. Every payment event that stays locked inside the Dashboard means manual re-entry somewhere in the business. This guide covers getting the API key, the n8n credential, the Stripe node and its limits, the Stripe Trigger for real-time reactions, and the HTTP Request node for everything else.

Why plug n8n into Stripe

Three motivations come up again and again in SMBs: accounting (every paid invoice should end up in a spreadsheet or accounting tool without copy-pasting), the customer lifecycle (a new subscriber must exist in the CRM and receive onboarding, a cancelled subscription should trigger a survey), and incident responsiveness (a failed payment followed up within the hour beats a weekly export).

This is exactly the kind of project where automation pays off most. The study by Mary Lacity and Leslie Willcocks, "A New Approach to Automating Services", published in 2016 in the MIT Sloan Management Review (see on Google Scholar), documented substantial first-year returns on investment across real-world cases of automating structured, repetitive service processes — precisely the profile of a Stripe billing flow.

Getting your Stripe API key

Everything happens in the Stripe Dashboard, under Developers → API keys. Two decisions to make:

Test mode or live mode. Stripe strictly separates the two environments: test keys (sk_test_…, rk_test_…) only see test data, live keys only see real data. Always build your workflow with a test key — Stripe's test cards (4242 4242 4242 4242…) simulate successful and failed payments risk-free.

Full secret key or restricted key. The secret key (sk_) grants total access: read, write, refunds, payouts. For n8n, prefer a restricted key (rk_), created via "Create restricted key": you tick, resource by resource, exactly the permissions needed (Customers: read, Coupons: write…). That's the principle of least privilege: if the key leaks, the blast radius is bounded, and you can revoke it without touching your other integrations. Create one key per use case ("n8n — reporting", "n8n — onboarding") rather than a single shared key.

Creating the credential in n8n

In n8n: Credentials → Add credential → Stripe API, paste the key into the Secret Key field, test, save. The key is then encrypted in the n8n database and referenced by nodes without ever appearing in plain text in the workflow. Never paste it directly into a node parameter or an expression: the habits detailed in our guide to securing API credentials — one credential per environment, rotation, no keys in logs — apply in full, with extra stakes here since this key touches money.

The Stripe node: what it covers (and what it doesn't)

The native Stripe node exposes the following resources:

• Customer: Create, Get, Get Many, Update, Delete — the foundation of any CRM sync;
• Charge: Create, Get, Get Many, Update — look up and create payments;
• Coupon: Create, Get Many — generate discount codes on the fly;
• Customer Card and Source: manage the payment methods attached to a customer;
• Balance: Get — the account balance, handy for a daily report;
• Token and Meter Event: payment tokens and usage-based billing events.

Note what's missing: invoices, subscriptions, Checkout sessions, payment links, and refunds are not covered by the native node. That's not a blocker — the HTTP Request node fills the gap, as we'll see below.

The Stripe Trigger: reacting to events in real time

The Stripe Trigger node is the more interesting half of the integration. When the workflow is activated, it automatically registers a webhook endpoint in your Stripe account, subscribed to the events you ticked — no manual configuration in the Dashboard. Among the most useful events:

• checkout.session.completed: a customer just completed a payment through Stripe Checkout — the typical entry point for automated onboarding;
• invoice.payment_succeeded and invoice.payment_failed: a subscription invoice was paid, or the charge failed;
• customer.subscription.created / updated / deleted: the entire subscription lifecycle, including plan changes and cancellations;
• charge.refunded, customer.created, or * to receive everything and filter afterwards (keep that for debugging: in production, subscribe to the strict minimum).

Two things to watch. First, Stripe retries delivering a webhook that doesn't get a quick response: the same event can arrive twice, which is why an idempotency key based on the event.id matters before any non-repeatable action. Second, every delivery is signed: never process a payment event without signature verification — the general principle is detailed in our guide to securing n8n webhooks.

HTTP Request: the full Stripe API, same credential

For everything the native node ignores — creating a subscription, listing invoices, generating a payment link — the HTTP Request node hits https://api.stripe.com/v1/… directly. Two ways to authenticate: the Predefined Credential Type option, which reuses your existing Stripe credential, or an Authorization: Bearer sk_… header stored as a Header Auth credential. One subtlety that wastes everyone's time: the Stripe API expects request bodies in application/x-www-form-urlencoded, not JSON — set the node's Body Content Type to "Form Urlencoded", otherwise your parameters will be silently ignored. Example: POST /v1/payment_links with line_items[0][price]=price_xxx and line_items[0][quantity]=1 returns a payment URL ready to send by email.

Three Stripe workflows that pay off fast

• Paid invoice → accounting: Stripe Trigger invoice.payment_succeeded → append a row to a Google Sheets tracker → generate the invoice or receipt PDF → archive to Drive. No more manual monthly exports.
• New subscriber → CRM + welcome: Stripe Trigger checkout.session.completed → upsert the contact using the pattern from our HubSpot/Pipedrive sync guide → personalized welcome email → Slack notification for the team.
• Failed payment → smart dunning: this use case deserves an article of its own — which events to listen to, deduplication, AI-written follow-ups and logging are covered step by step in our guide n8n + Stripe: automating failed payment follow-ups.

And if you sell through an online store, these patterns combine directly with those from our guide to connecting Shopify to n8n.

Security: three non-negotiable rules

Verify webhook signatures. A webhook URL can be guessed or leaked; the Stripe signature guarantees the event genuinely comes from Stripe and hasn't been tampered with. A forged invoice.payment_succeeded event accepted without verification is potentially access delivered without payment.

Never log or store card data. Your workflows should only handle Stripe objects (customer IDs, amounts, statuses), never card numbers: that's the foundation of the PCI DSS compliance you delegate to Stripe. Research is a reminder that even the most widely deployed protocols have flaws: the study "Chip and PIN is Broken" by Murdoch, Drimer, Anderson and Bond, awarded at the 2010 IEEE Symposium on Security and Privacy (see on Google Scholar), demonstrated an EMV protocol flaw allowing a payment to be validated without knowing the PIN. Payment security is a full-time discipline: leave sensitive data with Stripe and let only the minimum flow through n8n.

Separate test and live. Two distinct credentials, unambiguously named, and a systematic check before activating a workflow: a test coupon created in live mode, or the reverse, happens more often than you'd think.

Summary

Connecting Stripe to n8n comes down to four building blocks: a restricted API key in test then live mode, an encrypted credential in n8n, the Stripe node for customers, charges and coupons, and the Stripe Trigger, which creates its own webhooks to react in real time — with the HTTP Request node filling in the rest of the API using the same credential. Every euro collected then becomes an event your workflows can act on: accounting, CRM, dunning. And to keep a clean trail of everything money-related, the Compliance & Audit Pack (€149) provides the Supabase audit trail and logged follow-up patterns that naturally complement this integration.