CLI · Payments development · Stripe
Stripe CLI
Inspect Stripe API data and test webhook handling while keeping development activity separate from live payments.
Test and live modes must stay distinct. The --live flag changes the target for supported commands. A script can affect real account data if its credentials or mode are wrong.
Understand the tool
What it does.
Stripe CLI is the stripe command for developing Stripe integrations. It can call API resources, receive webhook events and forward them to a local application. A webhook is a message Stripe sends when something happens, such as a successful payment.
Why use it?
It is useful when you need to understand an integration's events before exposing an application publicly. Work in a selected sandbox, inspect the request and verify your application's response. A passing local test is one piece of evidence, not approval to handle real payments.
A useful fit for
- Webhook development
- Sandbox API inspection
- Payment-integration troubleshooting
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Check a webhook handler
An application must update an order after a test payment event.
- Select a sandbox and start the local handler.
- Forward only the needed event types and use the provided signing secret.
- Verify the response and confirm repeated delivery does not duplicate the update.
Intended outputEvidence that the handler accepts a valid event and manages repetition.
Use case 02
Inspect test customer data
A developer needs to confirm that a sandbox workflow created the intended records.
- Confirm the selected account and sandbox.
- List a small number of customer records.
- Compare expected fields without copying sensitive data into shared logs.
Intended outputA bounded inspection of development data.
A concrete starting point
List a small set of sandbox customers
After selecting and authenticating to the intended sandbox, this lists up to three customers. The CLI's documented default is sandbox requests; do not add --live for a development check.
stripe customers list --limit 3What this can change
Makes an authenticated API read and prints customer data. It does not create a customer or charge a payment, but output may still contain sensitive information.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- Installed Stripe CLI
- An authorized Stripe sandbox or documented sandbox setup
- A local application and signing-secret configuration for webhook forwarding
- Authentication
- Stripe login or configured API credentials; account, sandbox and credential scope determine access.
- Can read
- Stripe resources available to the credential
- Webhook payloads and API responses
- Can write or change
- API objects and test fixtures when write commands are invoked
- Local configuration and forwarded webhook requests
- Network and data flow
- Stripe APIs
- The explicitly configured local or remote forwarding endpoint
- Approval and control
- The CLI follows credential permissions. Confirm sandbox versus live mode before invoking commands that create or modify records.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Windows, macOS and Linux
- Webhook/API behavior depends on the selected Stripe API version and event type
Costs and account requirements
The CLI is open source. Live Stripe services and payment products have their own pricing; development access does not remove those charges.
Current pricing or plan information ↗Apache-2.0
The CLI license does not grant additional access to Stripe services or change payment-service terms.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Test and live modes must stay distinct
The --live flag changes the target for supported commands. A script can affect real account data if its credentials or mode are wrong.
Webhook forwarding moves data
Forwarded payloads and signing secrets should stay within the intended development environment. Verify signatures and avoid recording sensitive payloads unnecessarily.
Where it may fall short
- Synthetic test events do not cover every live payment failure or delivery pattern.
- The CLI is a development interface, not a replacement for application-side payment controls.
Observed behavior · 2026-10-18
Runtime and security findings.
Account-free dry runs serialized GET and POST requests and accepted the live-mode flag. No request was submitted to Stripe and no payment, customer or webhook was created.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
A dry run is a request preview, not permission proof
GET, POST and --live previews returned exit 0 with no credentials. They establish serialization only; neither account access nor live/test permission was validated.
In practice: Inspect the preview, then verify the selected account and mode separately in a dedicated Stripe sandbox before any real write.
Documented concern · medium severity under stated conditions
Test mode still changes account data when actually executed
The official CLI can create test objects and trigger events. This pass never ran those account operations.
In practice: Use a dedicated sandbox and plan cleanup; reserve live mode for reviewed actions with narrowly scoped credentials.
Version, environment and fixture
- Version or deployment
- 1.54.0
- Tested target
- Official Stripe CLI Windows x64 release archive
- Artifact identity
- SHA-256 9653307aa5bf56f1fa8b8c1ca981e42b0be39af5d6ef5e5eb3686061450c7e4b of the official downloaded stripe.zip artifact.
- Environment and fixture
- Windows 11 x64; Python 3.12.10 harness. Raw timestamps UTC.
- Fresh per-tool home/config/cache; child environment constructed from OS/runtime paths, explicit isolation variables and no inherited credentials. Synthetic fixtures only; no user account sign-in.
Checks and results
4 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Downloaded versionMet expectation
- Method
<evaluation>\downloads\cli\stripe\stripe.exe --version- Expected
- Print the pinned binary version.
- Observed
- Exit 0. stripe version 1.54.0
Preview a customer-list requestMet expectation
- Method
<evaluation>\downloads\cli\stripe\stripe.exe get /v1/customers --limit 2 --dry-run- Expected
- Emit GET /v1/customers with limit=2, without sending it.
- Observed
- Exit 0. { "dry_run": { "method": "GET", "url": "https://api.stripe.com/v1/customers", "params": { "limit": "2" }, "headers": {} } }
Preview a customer-create requestMet expectation
- Method
<evaluation>\downloads\cli\stripe\stripe.exe post /v1/customers --data description=ionbin-synthetic-only --dry-run- Expected
- Emit POST /v1/customers with the synthetic description, without sending it.
- Observed
- Exit 0. { "dry_run": { "method": "POST", "url": "https://api.stripe.com/v1/customers", "params": { "description": "ionbin-synthetic-only" }, "headers": { "Content-Type": "application/x-www-form-urlencoded" } } }
Preview live mode without credentialsMet expectation
- Method
<evaluation>\downloads\cli\stripe\stripe.exe get /v1/customers --live --dry-run- Expected
- Observe what the live flag validates during dry-run.
- Observed
- Exit 0. Dry-run JSON contained GET https://api.stripe.com/v1/customers with empty params and headers. It did not establish live-account authentication or mark an authorized live request.
Practical caveats
- The tested previews do not demonstrate authentication, API validation, idempotency or webhook signatures.
- A successful --live dry-run is not evidence that a live operation is allowed.
What this evaluation does not establish
- Authenticated sandbox/live API requests, key scope enforcement and object lifecycle.
- Webhook forwarding/signature verification, event replay, payment execution and idempotency behavior.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
An editorial specialist pick: it solves a concrete webhook-development problem with documented sandbox behavior. It is relevant primarily to Stripe integrations.
The number is an editorial starting order within the cli tools collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Official CLI, API-resource and webhook-listening documentation
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Stripe CLI overview ↗docs.stripe.com
- API-resource commands ↗docs.stripe.com
- Webhook listening and mode flags ↗docs.stripe.com
- Official source and license ↗github.com