Agent report card
Can an agent use Stripe Payments API through API payment lifecycle?
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateReady
- Sign upLimited
- PayLimited
- ProvisionLimited
- OperateLimited
The exact service and stable evaluation or access entrypoints are publicly discoverable.
The Stripe API Reference provides the exact service entrypoints, including the Base URL (https://api.stripe.com) and link to the development quickstart guide.
Only some material eligibility conditions are decidable before commitment.
Applicable terms are stable, readable, retrievable, and materially complete.
Price or no-charge status, variables, currency, and material conditions are explicit.
Verified structured artifacts accelerate discovery of the evaluation surface.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshOnly some material eligibility conditions are decidable before commitment.
Stripe Services Agreement General Terms state that the agreement applies based on the User's Stripe Account Country, and that a Representative submitting an application represents they have full authority to legally bind the User. Complete eligibility conditions depend on specific Service Terms and the Prohibited and Restricted Businesses List.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
Stripe's pricing page explicitly states rates and variables for payment optimisations (e.g., A$0.04 per 3D Secure attempt for custom pricing, A$0.15 for standalone 3DS) and confirms that Stripe does not charge setup fees or monthly fees for standard pricing.
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
The Stripe API Reference provides the exact service entrypoints, including the Base URL (https://api.stripe.com) and link to the development quickstart guide.
Are verified structured discovery artifacts available?
supported: freshVerified structured artifacts accelerate discovery of the evaluation surface.
The Stripe API Reference explicitly links to structured discovery artifacts, including 'llms.txt' ('LLM? Read llms.txt.').
Can an agent retrieve and understand the applicable commitment terms?
supported: freshApplicable terms are stable, readable, retrievable, and materially complete.
The Stripe Services Agreement General Terms are publicly accessible and readable, explicitly governing access to and use of the Services and Stripe Technology.
Does the vendor deliberately describe access for web agents?
supported: freshCurrent admissible evidence does not resolve this finding.
The provided documentation captures do not contain verified web-agent access rules or robots.txt directives for the assessed resources.
Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
Stripe documentation establishes restricted API keys with specific permissions and documents manual revocation/rotation rules when keys are lost, compromised, or team members leave, but leaves creation/issuance manual.
A stable canonical route begins the required access bootstrap.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured registration endpoint returned an incompatible browser notice, leaving access control operability unresolved in the current evidence.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
A stable registration metadata description establishes a sign-up route to create a Stripe account and start accepting payments at https://dashboard.stripe.com/register.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured registration targets returned browser compatibility notices without demonstrating the presence or absence of a CAPTCHA challenge.
Can an agent obtain scoped, revocable authority for this service?
supported: freshMachine credentials exist but require manual copying, broad authority, or weak lifecycle support.
Stripe documentation establishes restricted API keys with specific permissions and documents manual revocation/rotation rules when keys are lost, compromised, or team members leave, but leaves creation/issuance manual.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The registration page capture returned an incompatible browser notice, providing no explicit evidence regarding phone verification requirements or safe handoffs.
What would improve this stage
- Provide scoped delegated authorization with consent, revocation, and deterministic resumption.
Self-service is tier- or condition-limited, or a bounded vendor review exposes status.
Stripe provides self-service standard pay-as-you-go card processing pricing starting with zero setup or monthly fees, but notes that large volume or unique business models require contacting sales for a custom package.
Charge or no-charge status, currency, recurrence, and material conditions are disclosed.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence lists Checkout and Payment Links as products, but it does not contain details establishing deterministic checkout construction, approval handoff, and resumption for agents.
Is the exact commercial commitment disclosed before authorization?
supported: freshCharge or no-charge status, currency, recurrence, and material conditions are disclosed.
Stripe discloses pricing for card payments at 1.7% + A$0.30 for domestic cards and 3.5% + A$0.30 for international cards (plus 2% if currency conversion is required), and billing options such as Pay as you go at 0.7% of Billing volume.
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
The evidence mentions 3D Secure authentication and payment authorization, but does not state a documented rail supporting scoped delegation or human-confirmed authorization with receipts.
Is a direct self-service path to paid access documented?
supported: freshSelf-service is tier- or condition-limited, or a bounded vendor review exposes status.
Stripe provides self-service standard pay-as-you-go card processing pricing starting with zero setup or monthly fees, but notes that large volume or unique business models require contacting sales for a custom package.
What would improve this stage
- Document a direct purchase path or bounded vendor review with machine-readable status.
Delivery needs additional human transfer or has weak scope or lifecycle semantics.
Stripe API keys are managed in the Dashboard. In live mode, secret keys are displayed only once upon creation for copying, establishing a manual dashboard display path rather than a fully automated agent credential exchange flow.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshDelivery needs additional human transfer or has weak scope or lifecycle semantics.
Stripe API keys are managed in the Dashboard. In live mode, secret keys are displayed only once upon creation for copying, establishing a manual dashboard display path rather than a fully automated agent credential exchange flow.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshA synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.
For asynchronous payment methods, PaymentIntents move to a processing state upon confirmation. Terminal outcomes are communicated via webhooks, with payment_intent.succeeded indicating success and payment_intent.payment_failed indicating failure, allowing agents to observe completion and reconcile failure.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
Provisioning of PaymentIntent resources is machine-triggerable via an HTTP POST request to /v1/payment_intents using API authentication.
What would improve this stage
- Deliver scoped access material through a secure documented machine-usable flow.
Only part of the credential lifecycle is agent-operable.
Stripe API keys can be managed, configured as restricted API keys, and rotated via the Dashboard or managed by hosting platforms. However, credential rotation and revocation depend on manual Dashboard steps or hosting platform automation rather than a direct programmatic agent API.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Applicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Stripe Payments API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets.
- payments-api
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshOnly part of the credential lifecycle is agent-operable.
Stripe API keys can be managed, configured as restricted API keys, and rotated via the Dashboard or managed by hosting platforms. However, credential rotation and revocation depend on manual Dashboard steps or hosting platform automation rather than a direct programmatic agent API.
Can an agent handle applicable failure modes safely?
supported: freshApplicable limits, errors, retry, idempotency, cancellation, and reconciliation semantics are documented.
Failure modes, HTTP status codes (such as 400, 401, 402, 403, 404, 409, 424, 429, 500), error types, retry guidance with exponential backoff, and idempotency semantics using the Idempotency-Key header on POST requests are documented.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
API requests are authenticated over HTTPS using API keys (such as secret keys or restricted API keys with specific permissions) provided via HTTP basic auth or headers under scoped authority.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
Essential API operation contracts across targets are stable and decidable, defining REST endpoints, HTTP verbs, JSON/form parameters, error responses, idempotency headers, and test card/event behaviors.
- payments-api
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
Every essential target resource is operable through standard REST API endpoints, supported official client libraries, and the Stripe CLI.
- payments-api
What would improve this stage
- Provide scoped expiry, rotation, revocation, compromise, and recovery operations.
What works
- Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.
What blocks agents
No stage is established as blocked.
Where autonomy is limited
- Sign up: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
- Pay: Self-service is tier- or condition-limited, or a bounded vendor review exposes status.
- Provision: Delivery needs additional human transfer or has weak scope or lifecycle semantics.
- Operate: Only part of the credential lifecycle is agent-operable.
What this grade establishes
14 of 14 graded signals have current supporting evidence. 0 of 5 additional barrier checks are verified.Unknown checks are not a pass or a confirmed blocker. This report is not proof of an end-to-end purchase or service session.
How the grade is derived
A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.
Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.
Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states.
Startup offers
Stripe on the startup-offers board
- Credits to offset Stripe fees and special pricing on Stripe invoicesStripe Startup Programme
- $20,000 in payment processing credit$20,000 in Processing Credit
Distribution
The grade’s badge
One stable image resolving the record’s current live facts, linking to the canonical page. Embed it once; it keeps itself current. Placement is never evidence and never affects rank.
[](https://sourcey.com/log/stripe/agent-readiness/stripe-payments-api/api-payment-lifecycle)Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzf0m4xk6m1tb8d5y3pr9wg2
- Projection
- sha256:9d5d993cf8becca579d781884f8807bdcd532a628427b5275787e99f1de59aa6
- Policy
- service-use-2026-09-07-blocking-barriers-r12 · sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration