{"slug": "your-ai-agent-can-move-money-in-stripe-here-s-how-to-stay-in-control", "title": "Your AI agent can move money in Stripe - here's how to stay in control", "summary": "Stripe now lets AI agents move money through its MCP server, including sending funds to others via Stripe Treasury, and requires human confirmation before any refund or payout in live mode leaves an account. For agents that need their own identity, Stripe introduced agent-tagged API keys that support permissions, rotation and expiration and are subject to Approval rules, which by default require designated reviewers for sensitive actions and prevent any actor, human or agent, from approving its own request. Stripe said the default rules cover refunds, payouts and outbound transfers, and users can tune them in the Dashboard under Settings > Approvals > Create rule, for example auto-approving refunds under $50 while requiring sign-off for refunds over $500.", "body_md": "With Stripe’s MCP server, AI agents can build your checkout page, run financial reports, and automate refunds or price adjustments. Now, agents can even send money to others, using [Stripe Treasury](https://stripe.com/treasury).\n\nAutomation makes running your business easier than ever. But how do you stay in control, when an agent can make refunds or payouts for potentially hundreds of dollars?\n\nWe’ll cover the two ways to give an agent access to Stripe - acting on your behalf, or as an independent actor - and how Stripe always keeps you in control.\n\n## Connect your agent to Stripe's MCP server on your behalf\n\nThe easiest way to get started is to [add Stripe’s MCP to your client](https://docs.stripe.com/mcp#manual) and authorize access to Stripe on behalf of your user account. You can select which accounts or sandboxes you want to grant access, and select read or write access to resources in each one. Once you’ve authenticated, your agent will determine which tools to call depending on your task.\n\n## Confirming sensitive actions\n\nIf your agent makes a refund or payout in live mode, Stripe requires you to confirm the action before money leaves your account. After confirmation, tell your agent to try again so the action can be completed.\n\nHuman confirmation prevents an agent acting on your behalf from making mistakes, and is only required for certain write actions - even if you’ve disabled your client from asking for permission before making tool calls to Stripe.\n\n## Giving your agent its own identity\n\nHuman confirmation keeps you in control when you're the one driving. But you need a different control when giving an agent its own identity in Stripe, independent of any one team member. For example, you may create a headless agent to monitor a customer support queue and reply to customer requests for refunds or price adjustments. OAuth doesn’t work here, because it’s tied to your login session, and every confirmation routes to you personally.\n\nTo create an agent with its own identity in Stripe, create an agent-tagged API key so it has long-lived, independent access to your Stripe account. Just like regular API keys, agent-tagged API keys support permissions, rotation and expiration, but they are subject to Approval rules, which treat the agent as an independent actor and require approval by designated reviewers for sensitive actions. To get started, [create an API key](https://docs.stripe.com/keys) from the Dashboard and select the option of \"Giving an AI agent access to operate your account\".\n\n## Approval rules for agents acting on their own\n\nWith [Approvals](https://docs.stripe.com/account/approvals), you can define rules to conditionally require approval from designated approvers before sensitive actions. For a refund bot, that might mean refunds under $50 go through automatically, while refunds over $500 need sign-off from someone on the support team, and no single actor (human or agent) can approve their own request by default.\n\nThis is a general-purpose control. It applies to team members and agent keys alike, whether the action comes through the Dashboard or the API. Stripe also ships default rules scoped specifically to agent-tagged keys - covering refunds, payouts, and outbound transfers - so there's a baseline of oversight in place the moment you create the key. From there, you tune it: who reviews, what conditions trigger review, and whether to require approval or block the action outright.\n\n## Create an approval rule\n\nSetting this up takes a few minutes in the Dashboard:\n\n1. Go to Settings > Approvals > Create rule.\n2. Choose a trigger action, such as Refund is created.\n3. Add a condition, such as Amount > $500.\n4. [Optional] Set the actor condition to agent-tagged API keys (by default, rules apply to all team members and agent keys).\n5. Choose designated reviewers, such as users with the Support Specialist role.\n6. Set the control to Require approval, and activate.\n\nWhen an agent performs an action that’s subject to an approval rule, the API returns an `approval_required` error instead of completing the action, and Stripe automatically submits an approval request for review. The agent can optionally provide additional justification.\n\n```\ncurl -X POST https://api.stripe.com/v2/core/approval_requests/apreq_123/update \\\n  -H \"Authorization: Bearer sk_live_...\" \\\n  --json '{\"reason\": \"Refund requested via support ticket #4821\"}'\n```\n\n## Reviewing agent requests\n\nDesignated reviewers can approve or deny requests in the Dashboard under Settings > Approvals > [Requests](https://dashboard.stripe.com/settings/approvals/requests). Here, you can see all the details of the request, including a justification provided by the agent summarizing the customer’s request.\n\nWhen a request is approved, Stripe automatically attempts the captured action. The request then transitions to `succeeded` or `failed`. When denied, the action is not completed. Requests that haven't been approved within 14 days expire automatically.\n\n## Closing the loop by notifying agents about approval\n\nYour agent can listen for the outcome over webhooks, so that it knows when a request has been approved or denied, and whether the action was successfully completed. These are the supported webhook events:\n\n```\nv2.core.approval_request.created\nv2.core.approval_request.approved\nv2.core.approval_request.canceled\nv2.core.approval_request.rejected\nv2.core.approval_request.expired\nv2.core.approval_request.succeeded\nv2.core.approval_request.failed\n```\n\n## How Stripe keeps you in control\n\nTogether, scoped credentials, human confirmation, and configurable approval let you decide which actions an agent may perform automatically and which require review.\n\n- Confirmation protects you automatically the moment you connect an agent via OAuth - no setup required, and it holds even if you've relaxed your own harness's safety checks.\n- Two-party approval is what you design once your agent becomes its own actor - deciding exactly which actions need a second set of eyes, and whose eyes those should be.\n\nYou don't have to choose one. Most teams start with the first and layer on the second the moment automation stops being an experiment and starts being infrastructure.", "url": "https://wpnews.pro/news/your-ai-agent-can-move-money-in-stripe-here-s-how-to-stay-in-control", "canonical_source": "https://stripe.dev/blog/your-ai-agent-can-move-money-in-stripe", "published_at": "2026-10-21 00:00:00+00:00", "updated_at": "2026-10-21 17:13:22.876387+00:00", "lang": "en", "topics": ["ai-agents", "ai-products", "ai-tools"], "entities": ["Stripe", "Stripe MCP server", "Stripe Treasury", "Approvals"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/your-ai-agent-can-move-money-in-stripe-here-s-how-to-stay-in-control", "markdown": "https://wpnews.pro/news/your-ai-agent-can-move-money-in-stripe-here-s-how-to-stay-in-control.md", "text": "https://wpnews.pro/news/your-ai-agent-can-move-money-in-stripe-here-s-how-to-stay-in-control.txt", "jsonld": "https://wpnews.pro/news/your-ai-agent-can-move-money-in-stripe-here-s-how-to-stay-in-control.jsonld"}}