Connecting Stripe for payments

Deskie processes payments through Stripe, and every workspace uses its own Stripe account. You connect Stripe by pasting your Stripe API keys into Deskie. Once connected, Deskie can charge cards, and optionally accept ACH bank payments, all against your own Stripe account. Money flows directly to you, not through Deskie.

How the per-workspace connection works

Deskie is multi-tenant, so each workspace stores its own Stripe credentials. There is no shared, platform-wide Stripe account. Your keys are saved against your workspace and are used only for your workspace's transactions.

Three values make up a Stripe connection in Deskie:

• Secret key: used on the server to create and confirm charges. It must start with sk_live_ or sk_test_. Restricted keys that start with rk_live_ or rk_test_ are also accepted.
• Publishable key: used in the browser to collect card and bank details securely. It must start with pk_live_ or pk_test_.
• Webhook signing secret: used to verify messages Stripe sends back to Deskie. It starts with whsec_. This is only required when you turn on ACH payments (see below).

Each value is read fresh from your workspace configuration whenever a payment runs, so updating a key takes effect without a redeploy.

Connecting your keys

You enter your keys in Deskie's settings, in the Stripe keys card. Paste your secret key and publishable key into their fields and save.

Deskie validates the format before saving to catch the most common copy and paste mistakes:

• A blank value is rejected, so saving an empty field will not silently wipe an existing key.
• The secret key field rejects anything that does not start with a valid secret or restricted key prefix. Pasting a publishable key into the secret field is caught here.
• The publishable key field rejects anything that does not start with pk_live_ or pk_test_.
• Leading and trailing whitespace is trimmed automatically, which prevents the common case where a copied key picks up a stray newline.

Use your Stripe test keys (the _test_ variants) while you are trying things out, then switch to your live keys when you are ready to take real money. Treat the secret key like a password: it is only ever used on Deskie's servers and is never exposed to the browser.

What connecting Stripe enables

Once your secret and publishable keys are saved, Deskie can charge customers across the product, including invoices, resource bookings, passes, events, and member sign-ups on your public website.

Card payments

Card payments work as soon as your secret and publishable keys are saved. No extra webhook setup is required to take cards.

ACH bank payments

Deskie can also accept ACH payments from US bank accounts, but this is off by default and must be turned on per workspace. ACH is enabled with the Enable ACH Payments toggle in the Stripe Settings card.

When ACH is enabled, Deskie adds the US bank account payment type alongside card on the charges it creates, and it uses Stripe Financial Connections with instant verification to verify the bank account. Because of this, you must also enable Financial Connections in your Stripe account for ACH to work.

ACH also depends on the webhook described below, which is why Deskie only asks for the webhook signing secret once you turn ACH on. A card payment confirms during checkout, but a bank debit settles asynchronously, so Deskie relies on Stripe to report the final outcome.

The webhook

A webhook is how Stripe tells Deskie what happened to a payment after the fact. Deskie exposes a single webhook endpoint per workspace at:

https://{your-workspace-slug}.deskie.com/api/webhooks/stripe

The exact URL for your workspace is shown, with a copy button, in the Stripe webhook setup steps inside settings once ACH is enabled.

Setting it up in Stripe

In your Stripe dashboard, under Developers, Webhooks, Add destination, add a webhook endpoint pointing at the URL above, then subscribe it to exactly these three events:

• payment_intent.succeeded
• payment_intent.payment_failed
• payment_intent.canceled

After saving the destination in Stripe, copy the webhook signing secret it gives you (it starts with whsec_) and paste it back into the Stripe Webhook Secret field in Deskie. The webhook secret is only saved when ACH is enabled.

What the webhook does when an event arrives

When Stripe posts an event to the endpoint, Deskie:

1. Reads the payment intent from the message and looks up the matching payment record to determine which workspace it belongs to.
2. Loads that workspace's own secret key and webhook signing secret.
3. Verifies the message signature with the workspace's webhook secret, so only genuine messages from your Stripe account are trusted.
4. Updates the payment record based on the event: a succeeded event marks the payment as paid, a failed event marks it as failed, and a canceled event marks it as cancelled.

Deskie only acts on payment_intent events. Other event types, and events for payments Deskie does not recognize, are acknowledged and ignored so Stripe does not keep retrying them. If a workspace has no secret key or no webhook secret configured, signature verification cannot run and the event is rejected, which is the safe default.

Putting it together

For card-only payments, saving your secret and publishable keys is all you need. To also accept ACH bank payments, enable Financial Connections in Stripe, turn on the ACH toggle in Deskie, create the webhook in Stripe subscribed to the three payment intent events, and paste the webhook signing secret back into Deskie. With keys in place, payments flow through the rest of Deskie, including automatic billing and invoices.