Connecting your Stripe or Square account
Recoura connects to Stripe and Square through OAuth, the same standard behind buttons like "Sign in with Google." You approve the connection and permissions to your Stripe and Square account. We don't have access to your password, and an API key is not needed. Once you're connected, we pull the last 90 days of failed transactions populate your dashboard and recovery options.
OAuth:
For Stripe, Recoura stores a single account ID rather than a password or a secret key. For Square, Recoura stores an encrypted access token, since Square doesn't offer the account-ID-only setup Stripe does. We do not handle any card data since all of our checkout flows are hosted through Stripe or Square.
What OAuth means in practice
OAuth lets one application act on your behalf inside another, with your explicit approval and without ever exposing your password to the app asking for access. Stripe's version runs on Stripe Connect, the same system Stripe built for platforms and marketplaces. Square runs its own flow on the same standard.
What matters most is that your approval happens on the processor's domain. It also means your processor, not Recoura, holds the permanent record of what you approved and when.
Connecting your account, step by step
On your end it's a few clicks depending on which processor you use. Here's what happens behind each OAuth flow.
-
Click "Connect Stripe"
Your browser is sent to Stripe's own authorization page. Nothing on your account has changed yet; you've simply arrived at Stripe to make a decision.
-
Approve Stripe OAuth
Look at the address bar and you'll see Stripe's domain. If you're signed in, Stripe shows you which account is about to connect and what's being requested.
-
Stripe hands back a one-time code
Once you approve, Stripe redirects you back to Recoura with a short-lived code that can only be used once, plus a security token we set at the start so we can confirm the request really came from you.
-
Our server, not your browser, exchanges the code
Recoura's server trades that code with Stripe directly to finish the connection. The exchange happens server to server, and there's nothing for you to copy or paste at any point.
-
We keep one value: your account ID
What we get back is your Stripe account identifier, something like
acct_1A2b3C..., and that's all we retain: no access token, no secret key, and no customer card data. -
You are connected
Recoura starts reading your failed and at-risk payments so it can show you what's recoverable. The whole process usually takes a few seconds start to finish.
-
Click "Connect Square"
Your browser is sent to Square's own authorization page. Nothing on your account has changed yet; you've simply arrived at Square to make a decision.
-
Approve on Square, and see exactly what's requested
Square shows you the specific permissions Recoura is asking for, limited to what's needed to find and recover failed payments, like reading payments and orders. You review the list and confirm. Your Square login never leaves that page.
-
Square hands back a one-time code
Once you approve, Square redirects you back to Recoura with a short-lived authorization code, plus a state value we set at the start so we can confirm the request really came from you.
-
Our server, not your browser, exchanges the code
Recoura's server trades that code with Square directly to finish the connection. The exchange happens server to server, and there's nothing for you to copy or paste at any point.
-
This is the step that differs from Stripe: we keep an access token
Square doesn't offer the account-ID-only setup Stripe does, so there's no way to act on your behalf without holding a credential for your account. Recoura stores that token encrypted at rest, scoped to the permissions you approved, and refreshes it automatically before it expires. It never leaves our servers, and it stops working the moment you revoke access.
-
You are connected
Recoura starts reading your failed and at-risk Square payments so it can show you what's recoverable, the same as it does for Stripe.
We'd rather store no token at all, and with Stripe we don't have to. Square simply doesn't offer an equivalent connection type yet. The guarantee is the same either way: Recoura can't move money out of your account, holds no balances, and never touches your customers' card numbers.
Recoura's scope of access to your data
Approving the connection grants Recoura a defined, limited scope: enough to find failed payments and to prepare and send recovery invoices for you. Every recovery action still runs through your processor's own API, and each one first passes through the Recovery Guard.The Recovery Guard double checks the payment status before anything is sent, so a customer is never asked to pay twice.
Recoura can't move money out of your account. It wasn't built to. The access we request lets us read payments and send invoices and reminders through Stripe or Square. We hold no balances, we initiate no transfers to ourselves, and card numbers never reach our servers; those stay with your processor the entire time.
Disconnecting
You control the connection to your payment processor, and there are two ways to end it. Both take effect right away.
- In Recoura. Open Settings and choose Disconnect next to the processor you want to remove. For Stripe, Recoura tells Stripe to revoke the authorization and deletes your stored account ID. For Square, Recoura revokes the stored access token with Square directly and deletes it from our servers.
- From your processor. In your Stripe Dashboard, open Connected apps (sometimes labeled Authorized applications) and revoke Recoura directly. In this section, you can also review every app with access to your account. In your Square Dashboard, the equivalent setting is under your account's app permissions.
In short
Overall, these are the same standards we'd want if we were the customer. For more details on what we store and why, see our privacy policy or the short version in the FAQ.