Stripe

Connect Stripe with a restricted key, and each run’s test customers are deleted when it ends, in test mode or live mode. Deleting a customer also ends its subscriptions.

Cleanup

Create a restricted key

In the Stripe dashboard, go to Developers → API keys → Create restricted key and give it exactly these permissions:

Resource	Permission	Why
Customers	Write	To find test customers by email and delete them.
Subscriptions	Write	Deleting a customer ends its subscriptions.
Charges	Read	To list any payments a test customer made (see below).
Invoices	Read	To list paid invoices, for the same reason.

Leave everything else as None. The connection test checks all four and names any that are missing. A full secret key (sk_…) is accepted too, but a restricted key (rk_live_… or rk_test_…) limits what a leaked key could do.

Add it to Flowproof

Load your API key and the Stripe key

Neither ends up in your shell history this way:

Terminal

read -rs FLOWPROOF_API_KEY   # paste your fp_ key, press Enter (nothing is shown)
export FLOWPROOF_API_KEY
read -rs STRIPE_KEY   # paste the rk_live_... or rk_test_... key, press Enter

Create the connection

Terminal

curl -s -X POST https://mcp.flowproof.dev/api/projects/acme/adapters \
  -H "Authorization: Bearer $FLOWPROOF_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"label\": \"Stripe\", \"config\": {\"system\": \"stripe\", \"apiKey\": \"$STRIPE_KEY\"}}"

Test, preview and arm
Use the requests on the Cleanup page with the id from the reply.

Test mode or live mode depends on the key. Use a live key if your agent tests against production, where real Stripe customers are created.

How it finds customers

For each address on the run’s list, Flowproof asks Stripe for customers with exactly that email, then checks each answer itself: a customer whose email isn’t exactly on the list is ignored and reported, never deleted. The only thing it deletes is a customer that passed that check.

Payments are never refunded

Deleting a Stripe customer doesn’t refund anything, and Flowproof never moves money: it can’t tell a test payment from a real one with the certainty a refund needs. If a test customer did pay, the receipt shows a skipped line with the number of payments and the total, so you know what to refund by hand. To avoid that entirely, use test checkout or Stripe test mode.