Stripe API key compromised and rotated but now I cannot disconnect stripe from ghost in order to update

Developer help
1

We have been using Stripe integration on Ghost and we have around 600 paid subscriptions. We got an email from Stripe that our API key was compromised and we need to rotate, so I did that, but now I cannot disconnect Stripe from Ghost in order to reconnect with the new API. I am seeing online that I should manually cancel all subscribers but that is not a functional option in our case. Can I update the link without affecting the active subscriptions on Ghost?

Thank you!

2

I asked the dev team back in June about how to replace a Stripe key without disconnecting and reconnecting. Here’s the suggestion from one of them. I have not tested and do NOT know if it’ll work. Make a backup first! (Example below uses localhost but you’d sub in your domain.)

If you’re in managed hosting, consider asking your host for help instead.

open http://localhost:2368/ghost/api/admin/members/stripe_connect?mode=test or http://localhost:2368/ghost/api/admin/members/stripe_connect?mode=live manually in the browser, complete the connect flow and copy the key

then run this from DevTools on the Ghost Admin site with the copied key in there

await fetch(‘/ghost/api/admin/settings/’, {

method: ‘PUT’,

credentials: ‘include’,

headers: {‘content-type’: ‘application/json’},

body: JSON.stringify({

settings: [{

key: ‘stripe_connect_integration_token’,

value: ‘PASTE_SECURE_KEY_HERE’

}]

})

}).then(r => r.json());

(alternatively make the change manually in the DB and restart)

So I think a reconnect to the same Stripe account is definitely do-able, just currently blocked at the UI level. Unless there are other side-effects I’m not aware of. Useful to fix a broken dev instance at least