Team Access Without Sharing the Password

Stripe accounts support additional users because businesses have bookkeepers, developers and partners. That is not the same as sharing the owner’s password. A shared password cannot be limited, cannot be revoked cleanly, and is exactly what a restriction looks for when the question is who controls the business.

If the only way to help is the password, the help is the problem.

What is actually moving

API keys are worse. A secret key can create charges and refunds without a person sitting in the dashboard. Pasting it into a chat, a freelancer’s laptop, or an assessment form is a permanent leak. RevRouters does not ask for keys. If a form does, close it.

• A role can be revoked.
• A password cannot be half-shared.
• An API key is the account in text form.
• A stranger with admin is a new controller.

What people confuse it with

During a review, adding a crowd of new administrators looks like the control of the account is changing. Add people you actually employ. Do not add a stranger who says they can talk to Stripe for you.

What to do with it

Give the smallest access that does the job, and keep the secrets.

1. Invite a user. Do not send the password.
2. Do not send recovery codes or API secrets.
3. Remove anyone who has left.
4. If an assessment needs a fact, export the fact. Do not export the login.