How this site works
This experiment by Mark Moriarty demonstrates signing in with an existing Stripe business account: sign in and post using the name from the selected Stripe account to one public message board. Email, Google and the planned Link option are included for comparison. It is not an official Stripe product.
Signing in with Stripe
The integration uses Stripe Apps OAuth. When Stripe sign-in is available, the button takes you to Stripe to choose an existing business account and authorize the Merchant Sign-in Demo app. Installation requires the Stripe account owner or an Administrator (including Super Administrator). A Developer-only or View-only role is not enough. See Stripe’s installation requirements.
“Install” means authorizing the app on your Stripe account. There is no download to your computer, and this demo has no Stripe Dashboard interface. Its app manifest requests no payment or customer-data permissions.
Stripe returns a short-lived, single-use authorization code. Our server checks that the response belongs to the sign-in attempt started in your browser, then exchanges the code with Stripe using the app developer’s credential. It uses the returned account identifier to recognize your board profile. With account-read access, it retrieves that account’s business name and website, retains only those profile fields and discards the provider tokens. The account display name (or business profile name when no display name is set) is used as the company name automatically and cannot be edited here; the human display name is chosen separately. During temporary Stripe API outages, a name previously read from the same account can be reused. If permission is denied or no name has been read, posting is unavailable until you refresh sign-in and the account name can be retrieved. Signing in again refreshes the name, including earlier aliases.
What does Sign in with Stripe access?
This site retrieves the authorized account through Stripe’s current-account endpoint, GET /v1/account, and checks that its identifier matches the OAuth account. The externally tested version of the shared Merchant Sign-in Demo app requests connected_account_read, which grants broader read access to account details and settings; the permissions shown by Stripe apply to the version you install. This site uses only the account name and website from the profile response. There are no name-only or website-only OAuth scopes. The demo does not change your Stripe account, add Dashboard views, or request payment/customer-data permissions. Existing installations may need to approve the updated app before those fields are available. See Stripe’s permission reference.
Stripe: one identity per business account
Stripe identifies the selected business account, not the individual teammate using it. An account contact email is not the teammate’s identity and is not retained. Public Stripe profiles are optional; a directory match is not an authentication claim. People who sign in through the same Stripe account share a company profile and ownership of its comments, while choosing separate human names for each browser. Your private Stripe account identifier is not shown on the board, and the displayed name comes from that account. This verifies account access, not the legal identity of the business or the human signing in. Account names can be changed in Stripe; they cannot be changed on this site.
Sessions and repeat visits
A necessary cookie keeps you signed in to this website for one hour. The session does not extend itself as you browse. After it expires, or after you sign out, you must sign in again. A valid website session avoids another trip to Stripe.
In this external test, signing in again still shows Stripe’s test warning and account selection. An account that already has the app gets a Continue button instead of Install app. Signing out here ends the website session; it does not sign you out of Stripe or uninstall the app.
External testing
This app is in development and has not been reviewed for publication in the Stripe App Marketplace. It uses Stripe’s external-testing programme, which permits up to 25 tester accounts. Anyone with the test link can currently apply to install it; Stripe sign-in may be unavailable when those slots are full. Only install an experimental app if you trust its developer. A disabled sign-in button means that method is not ready to use.
Email, Google and the board
Email sign-in sends a six-digit code and a link. Use either one within two hours. Signing in with either uses up both. Google sign-in requests an account identifier and email, without requesting your name or photo. The Google account identifier remains the identity key. Only a cryptographically verified, email-verified Google Workspace domain is retained as domain evidence; other custom Google email addresses need fresh mailbox proof through email sign-in. Your full Google email is not stored or displayed. Each sign-in method has a separate profile; we do not merge accounts by matching email addresses. Link sign-in is not available yet.
Anyone can read comments. You must sign in to post or delete your own comments. Everyone can choose a human display name; only Stripe supplies the company name for Stripe participants. Deletion hides a comment immediately and offers five seconds to undo it. Avoid posting private information. See the privacy explanation for stored records and deletion details.
Choose how to participate
Everyone chooses a public human display name. These names are freely typed and are not verified. Email and Google users start as individuals. If a current verified mailbox or Google Workspace claim establishes a non-shared email domain, they may choose to show that exact domain. Company affiliation cannot be typed or inferred. Known public, forwarding and disposable email providers—including Gmail, Yahoo and Proton—remain individual-only. The lists contain more than 100,000 domains but are not exhaustive.
The “Verified email domain” label proves email access, not employment, domain ownership or authority to represent a company. Affiliation is private until explicitly selected; showing or hiding it updates earlier comment labels too. Stripe comments record the freely chosen human name for that browser. Email/Google names update across their comments; the chosen domain also applies to earlier comments. A changed domain needs a new explicit opt-in; Google domain evidence expires after a day without refreshed sign-in.
Stripe participants always use their Stripe-sourced company name and the “Admin” label. Each browser remembers a separate human name; teammates still share ownership of that account’s comments. The name from Stripe cannot be changed here. This verifies account access, not the human’s admin role or website ownership. Stripe says all teammates can use an installed app. Live mode and KYC are not domain-ownership certificates: Stripe can separately ask for website ownership evidence. A stronger domain-owner claim would require separate proof, such as a DNS TXT challenge; this demo does not make that claim.