Keep Stripe API Keys Off Laptops

Overview

You may want employees to use a subset of a third-party production API, such as Stripe, for a narrow set of tasks. Without Formal, this usually means giving them a production API key with broader permissions than you want to allow. That key then sits on their laptop, in a .env file or shell profile. With Formal, you can use the and a to:

Keep the API key off employee laptops. Only the Connector holds it.
Let employees make authenticated requests to the Stripe API without a credential.
Write fine-grained policies against every request between the laptop and Stripe.

This guide uses curl on macOS.

How It Works

The Formal Endpoint on macOS intercepts curl requests to api.stripe.com with a network rule.
The Endpoint forwards them to the Connector with the developer’s Formal identity.
A on the Stripe injects Authorization: Bearer <STRIPE_API_KEY>.
Stripe receives the real key. The laptop never does.

Clients keep calling https://api.stripe.com. You do not change base URLs.

Prerequisites

on macOS with Transparent Mode enabled
A deployed the Endpoint can reach
Stripe API Key

1. Store the key on the Connector

Set the key as the STRIPE_API_KEY environment variable on the Connector.

2. Create the Stripe resource

Control Plane
Terraform

Navigate to Resources and click Create Resource
Set Technology to HTTP
Set Name to stripe
Set Hostname to api.stripe.com and Port to 443
Save the resource
Add a TLS configuration to the resource and select Verify Full

resource "formal_resource" "stripe" {
  name       = "stripe"
  technology = "http"
  hostname   = "api.stripe.com"
  port       = 443
}

resource "formal_resource_tls_configuration" "stripe" {
  resource_id = formal_resource.stripe.id
  tls_config  = "verify-full"
}

Verify Full makes the Connector check the certificate chain and hostname of api.stripe.com before it sends the API key.

3. Add a Native User for the key

The Native User tells the Connector to set Authorization: Bearer <key> on every Stripe request. It replaces any Authorization header the client sent.

Control Plane
Terraform

Open the stripe resource and select Authentication
Click Add User and select HTTP Bearer
Set Label to stripe-api-key
Choose Static, set the header to Authorization, and choose Environment Variable
Enter STRIPE_API_KEY and click Create
Copy the Native User ID from its action menu
Under Default Native User, paste that ID as the CEL expression and click Save

"nativeuser_01km5mz0x5t6t9gs195s5dhe73"

resource "formal_native_user_v3" "stripe" {
  resource_id = formal_resource.stripe.id
  label       = "stripe-api-key"

  http_bearer {
    header = "Authorization"
    token {
      environment_variable = "STRIPE_API_KEY"
    }
  }
}

resource "formal_resource_native_user_selection" "stripe" {
  resource_id = formal_resource.stripe.id
  cel         = "\"${formal_native_user_v3.stripe.id}\""
}

Set a default Native User. Without one, HTTP resources forward requests without an injected key, and Stripe returns 401.

See Native Users for all selection fields. Verify: The stripe-api-key Native User appears under Native Users with type HTTP Bearer and source STRIPE_API_KEY.

4. Make Stripe reachable through the Connector

Control Plane
Terraform

Open your Connector and select Listeners
Create a listener on an available port, such as 443. Port 8080 is reserved for health checks.
Open the listener, click New Rule, set the type to Resource, and select stripe

resource "formal_connector_listener" "stripe" {
  connector_id = formal_connector.example.id
  name         = "stripe-listener"
  port         = 443
}

resource "formal_connector_listener_rule" "stripe" {
  connector_listener_id = formal_connector_listener.stripe.id
  type                  = "resource"
  rule                  = formal_resource.stripe.id
}

Verify: stripe appears under the Connector’s Reachable Resources.

5. Forward Stripe traffic to the Connector

Create a network rule that intercepts curl requests to api.stripe.com and forwards them to the Connector. Match curl by its code signing identifier in pre_tcp, and check the hostname in pre_tls. Find the identifier with codesign:

codesign -dvv $(which curl) 2>&1 | grep '^Identifier'
# Identifier=com.apple.curl

Control Plane
Terraform

Navigate to Network Rules
Create a rule named stripe-curl
Paste the CEL below
Save the rule and set it to Active

{
  "condition": {
    "pre_tcp": process.signing.code_identifier == "com.apple.curl",
    "pre_tls": hostname == "api.stripe.com",
    "post_tls": true
  },
  "outputs": {
    "resource_name": "stripe",
    "forward_to_connector": true
  }
}

resource "formal_network_rule" "stripe_curl" {
  name        = "stripe-curl"
  description = "Forward curl requests to Stripe to the Connector for key injection"
  status      = "active"

  cel_expression = <<-EOT
    {
      "condition": {
        "pre_tcp": process.signing.code_identifier == "com.apple.curl",
        "pre_tls": hostname == "api.stripe.com",
        "post_tls": true
      },
      "outputs": {
        "resource_name": "stripe",
        "forward_to_connector": true
      }
    }
  EOT
}

Forward to Connector must be true. Without it, the Endpoint evaluates the request locally, and no Native User injects the key.

6. Restrict Stripe requests with a policy

The default Native User injects the key into every request that reaches the stripe resource. Add a policy that blocks every Stripe request except the ones your developers need. This example lets the payments-engineers group read balances, charges, and customers. It blocks all other Stripe requests, including writes and requests from other users.

Control Plane
Terraform

Navigate to Policies
Click Create Policy
Set name to stripe-read-only and add a description
Paste the Rego below into the editor
Click Create Policy to save

package formal.v2

import future.keywords.if
import future.keywords.in

allowed_paths := {"/v1/balance", "/v1/charges", "/v1/customers"}

allowed if {
  "payments-engineers" in input.user.groups
  input.http.method == "GET"
  some path in allowed_paths
  startswith(concat("", [input.http.path, "/"]), concat("", [path, "/"]))
}

request := {
  "action": "block",
  "type": "block_with_formal_message",
  "reason": "This Stripe request is not allowed"
} if {
  input.resource.hostname == "api.stripe.com"
  not allowed
}

resource "formal_policy" "stripe_read_only" {
  name        = "stripe-read-only"
  description = "Allow payments engineers to read Stripe balances, charges, and customers"
  status      = "active"

  module = <<-EOT
    package formal.v2

    import future.keywords.if
    import future.keywords.in

    allowed_paths := {"/v1/balance", "/v1/charges", "/v1/customers"}

    allowed if {
      "payments-engineers" in input.user.groups
      input.http.method == "GET"
      some path in allowed_paths
      startswith(concat("", [input.http.path, "/"]), concat("", [path, "/"]))
    }

    request := {
      "action": "block",
      "type": "block_with_formal_message",
      "reason": "This Stripe request is not allowed"
    } if {
      input.resource.hostname == "api.stripe.com"
      not allowed
    }
  EOT
}

Adjust allowed_paths, the methods, and the group to match what your developers need. Find Stripe paths in the Stripe API reference. See HTTP object for all request fields. Verify: A GET /v1/balance from a payments-engineers member succeeds. A POST /v1/refunds returns the Formal block message.

7. Call Stripe without a key

Remove Stripe keys from .env files, shell profiles, and CLI configs on the laptop. Then call Stripe with curl and no key:

curl https://api.stripe.com/v1/balance

Verify:

Open Logs and filter on the stripe resource
Confirm the request shows the developer’s Formal identity
Confirm the response status is 200

Troubleshooting

Requests do not appear in Formal logs

Possible causes:

Transparent Mode is off
The network rule is in Draft
curl is not /usr/bin/curl, for example Homebrew curl, so its code signing identifier differs

Fix:

Run formal transparent-proxy status
Set the stripe-curl network rule to Active
Run codesign -dvv $(which curl) and use its Identifier in pre_tcp

Next Steps

Stripe API Keys

Manage Stripe API keys

Native Users

Select credentials by identity or with hooks

HTTP Resources

Write policies for HTTP traffic

Network Rules

Choose which traffic the Endpoint intercepts

Encrypt MCP OAuth Tokens

Keep OAuth tokens encrypted on the device

Getting Started

Example Use Cases

AI Governance

Configuring Formal

Integrations

Configuration

Overview

How It Works

Prerequisites

1. Store the key on the Connector

2. Create the Stripe resource

3. Add a Native User for the key

4. Make Stripe reachable through the Connector

5. Forward Stripe traffic to the Connector

6. Restrict Stripe requests with a policy

7. Call Stripe without a key

Troubleshooting

Next Steps

Stripe API Keys

Native Users

HTTP Resources

Network Rules

Encrypt MCP OAuth Tokens

​Overview

​How It Works

​Prerequisites

​1. Store the key on the Connector

​2. Create the Stripe resource

​3. Add a Native User for the key

​4. Make Stripe reachable through the Connector

​5. Forward Stripe traffic to the Connector

​6. Restrict Stripe requests with a policy

​7. Call Stripe without a key

​Troubleshooting

​Next Steps

Stripe API Keys

Native Users

HTTP Resources

Network Rules

Encrypt MCP OAuth Tokens

Overview

How It Works

Prerequisites

1. Store the key on the Connector

2. Create the Stripe resource

3. Add a Native User for the key

4. Make Stripe reachable through the Connector

5. Forward Stripe traffic to the Connector

6. Restrict Stripe requests with a policy

7. Call Stripe without a key

Troubleshooting

Next Steps