# Stripe and Pilotiko: linking your payments account

> Connecting your Stripe account to Pilotiko: the read_write OAuth scope, what is wired up today, what is not yet, and how to remove Pilotiko's access.

Updated on October 15, 2026 · https://app.pilotiko.com/en/integrations/stripe

Today Pilotiko can link your Stripe account through Stripe Connect (OAuth, read_write scope), but it does not use that link yet: no charges, no payment reads, no refunds. Status: Account connection only: no automatic actions for now. Your customers keep paying exactly as they do now, inside Stripe.

## In short
- Status: Account connection only: no automatic actions for now.
- Access requested: Stripe Connect with the **read_write** scope, without PKCE.
- Nothing is wired to it yet: no charges, no transaction reads, no refunds.
- This is not the Stripe account Pilotiko uses to bill its own subscription.
- You can withdraw access in one click in Pilotiko and from the Stripe side.

## What does the Stripe connection do in Pilotiko?

It stores a Stripe Connect authorization on behalf of your business. It does not trigger any operation on your account yet.

Pilotiko's capability registry lists Stripe under Payments (getting paid by your customers) with a **connect-only** status. In practice, the authorization round trip works: you click Connect, Stripe asks you to approve Pilotiko, and Pilotiko keeps the token it receives. No feature in the product calls Stripe with that token afterwards.

The request goes to the Stripe Connect authorize URL with the **read_write** scope. Stripe documents two values, read_write and read_only, and notes that read_only can only be requested by extensions [1]. The authorization code Stripe sends back is single-use and expires after 5 minutes [1]. The flow follows the OAuth 2.0 framework, so your Stripe password is never shared with Pilotiko [2].

Why link an account that is not used yet? So that, once payment collection ships, your authorization is already in place and Pilotiko knows which account speaks for the business. Until then, the Connections page says plainly that the link exists but Pilotiko does not act on it.

- **read_write**: the access level Stripe grants Connect platforms. Pilotiko asks for it but makes no payment API call with it.
- **Data read today**: none. Pilotiko does not look at balances, Stripe customers or payouts.
- **Data written today**: none. No charge, no refund, no payment link is created.
- **What will require approval later**: any charge or refund moves money, so a person will have to approve it, like every Pilotiko action that touches a customer or money.

## How do I connect Stripe to Pilotiko?

There is no key to paste. If the button is missing for your business, Pilotiko has not switched on its Stripe app yet, and the card says so rather than showing a dead button.

1. **Open Connections** — In Pilotiko, open the Connections page and find the Stripe card in the Payments group.
2. **Click Connect** — Pilotiko generates a one-time state value tied to your business and your user, valid for 10 minutes.
3. **Approve in Stripe** — Sign in to Stripe and accept the read_write access request for your business account.
4. **Return to Pilotiko** — Pilotiko checks the state value, swaps the code (Stripe gives it 5 minutes) and encrypts the token.
5. **Check the card** — The card reads Connected and reminds you that no automatic action runs for now.

## What is available, being commissioned or coming soon with Stripe?

| Function | Status | Detail |
|---|---|---|
| Link your Stripe account (Connect OAuth) | Account connection only: no automatic actions for now | read_write authorization stored, encrypted |
| Charge a customer's card | Coming soon | No payment call has been built |
| Read your Stripe payments and customers | Coming soon | Nothing is read |
| Refunds | Coming soon | Will need a person's approval |
| Disconnect (Pilotiko side) | Available | Tokens erased, action written to the audit log |

The Stripe account that bills your Pilotiko subscription belongs to Pilotiko. It is separate from yours.

## What does a week of Stripe payments look like with the link in place?

**Example: a repair shop that takes 18 Stripe payments in one week**

The shop linked Stripe to Pilotiko on Monday. Over the week, customers settle 18 invoices through the Stripe payment link the shop already used. Here is what Pilotiko does with those payments today.

- Payments received in Stripe : 18
- Total collected in Stripe : $2,340
- Payments read by Pilotiko : 0
- Payments created or refunded by Pilotiko : 0
- Invoices to reconcile by hand in Pilotiko : 18
- **= All 18 payments stay fully managed in Stripe; Pilotiko does not touch them.**

## How does Pilotiko protect Stripe access under Quebec's Law 25?

The Stripe token is encrypted at rest with AES-256-GCM, never leaves the server and never appears in a log. Quebec's private-sector privacy act requires consent that is manifest, free, enlightened and given for specific purposes, valid only as long as needed [3]. Linking Stripe is therefore a deliberate step, explained on the card, that you can undo.

Section 8 of the act requires telling people why information is collected and that they may withdraw consent [3]. See our [privacy policy](/en/privacy) and the [security page](/en/security).

To remove access: in Pilotiko, Disconnect erases the token and logs the action. On Stripe's side, a platform can be deauthorized; Stripe documents the /oauth/deauthorize call and removing a connected account from the Dashboard (Remove account), after which the platform can no longer reach the account [1].

## What are the limits of the Stripe connection?

Stripe states that since June 2021, platforms using OAuth with read_write cannot connect accounts that are controlled by another platform [1]. If another software product created and controls your Stripe account, the link may be refused.

No real Stripe account has been linked to Pilotiko yet: the OAuth app is not registered. For in-person payments, see [Square](https://app.pilotiko.com/en/integrations/square) or [Clover](https://app.pilotiko.com/en/integrations/clover), which share the same status. Every connection is listed by status on the [Integrations](https://app.pilotiko.com/en/integrations) page; for social publishing, see [LinkedIn](https://app.pilotiko.com/en/integrations/linkedin).

## Frequently asked questions

### Can Pilotiko charge my customers through Stripe?

Not yet. The link only stores your authorization; Pilotiko creates no payment. Your customers pay exactly as before, in Stripe.

### Why does Pilotiko ask for read_write instead of read_only?

Stripe reserves read_only for extensions, so a Connect platform asks for read_write. Pilotiko still uses none of those permissions today.

### Is this the same Stripe as my Pilotiko subscription?

No. Pilotiko bills its subscription through its own Stripe account. Yours stays separate and the two are never mixed.

### How do I remove Pilotiko's access to my Stripe account?

Click Disconnect on the Connections page: the token is erased and the action is logged. You can also remove the platform from the Stripe side.

### Does Pilotiko see my Stripe balance or payouts?

No. No read is wired up, so Pilotiko sees no balance, customer or payout.

### What changes once payment collection ships?

The Stripe card and this page will change status. Any charge or refund an agent proposes will wait for a person's approval before it happens.

## Sources

1. Stripe Docs, « Connect OAuth reference », https://docs.stripe.com/connect/oauth-reference (accessed on 2026-10-15)
2. RFC Editor (IETF), « RFC 6749 : The OAuth 2.0 Authorization Framework », https://www.rfc-editor.org/rfc/rfc6749 (accessed on 2026-10-15)
3. LégisQuébec, « Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) », https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed on 2026-10-15)