From b3cfc11a20217f4c2ee8356eb6a7169533807c2c Mon Sep 17 00:00:00 2001 From: Kyle Swank Date: Fri, 11 Sep 2026 14:47:38 -0400 Subject: [PATCH] fix(data-warehouse-source): name Stripe's restricted-key scopes and link the docs The Stripe pre-flight gotcha only said "wants a restricted key, not sk_live_..." with no scopes and no docs link, so the wizard's wizard_ask prompt to the user was bare. Give Stripe its own bullet listing the exact scopes (Core/Billing/Connect reads, Webhooks write) and linking the restricted-key docs section. Also tell the agent explicitly that Stripe has no URL parameter to pre-select those scopes, so it doesn't invent one. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01PcwfZr4Ag73MP2xwFFUF33 --- context/skills/data-warehouse-source/description.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/context/skills/data-warehouse-source/description.md b/context/skills/data-warehouse-source/description.md index b7b9753a..5c0ac3af 100644 --- a/context/skills/data-warehouse-source/description.md +++ b/context/skills/data-warehouse-source/description.md @@ -49,7 +49,8 @@ Surface these **before** collecting credentials — they're the top reasons setu - **The host must be reachable from PostHog's network.** `localhost`, `127.0.0.1`, and private/RFC-1918 hosts (`10.x`, `192.168.x`, `172.16–31.x`) are rejected — PostHog connects from its own infrastructure, not the user's machine. Serverless/managed Postgres (Neon, Supabase, RDS behind strict rules) often also needs PostHog's egress IPs allowlisted first. If the database isn't publicly reachable, go straight to the deep-link path instead of collecting credentials that can't validate. - **Supabase has its own source type — use `Supabase`, not `Postgres`.** PostHog lists `Supabase` as a source type of its own, so call `external-data-sources-wizard` with `source_type: "Supabase"` and ask for the fields it returns. Its `host` field carries the Session-pooler guidance in its own caption. Pass that caption on to the user rather than writing your own. The password is the **database** password (Supabase → Settings → Database). It is not an `anon` or `service_role` JWT key, and not the account password. If `SUPABASE_URL` exists in the env, derive the project ref from `db..supabase.co` to pre-fill the host and username in your prompt. -- **Many SaaS sources need a specific key type or plan** — name the right one in your `wizard_ask` prompt so the user doesn't paste the wrong thing: **Stripe** wants a _restricted_ key (`rk_live_…`), not `sk_live_…`; **Sentry** wants an internal-integration token (not a DSN or personal token); **RevenueCat** a v2 secret key with read scopes; **Convex** requires the Professional plan; **Twilio** an API Key SID + Secret (not the account auth token); **Mailchimp** a key with its `-usX` datacenter suffix. For send-only services (Resend, Mailgun) the key in the env is often restricted — the warehouse import needs a full/read-access key. +- **Many SaaS sources need a specific key type or plan** — name the right one in your `wizard_ask` prompt so the user doesn't paste the wrong thing: **Sentry** wants an internal-integration token (not a DSN or personal token); **RevenueCat** a v2 secret key with read scopes; **Convex** requires the Professional plan; **Twilio** an API Key SID + Secret (not the account auth token); **Mailchimp** a key with its `-usX` datacenter suffix. For send-only services (Resend, Mailgun) the key in the env is often restricted — the warehouse import needs a full/read-access key. +- **Stripe wants a _restricted_ key (`rk_live_…`), not a secret key (`sk_live_…`).** Name the exact scopes in your `wizard_ask` prompt so the user can check them in one pass instead of guessing: Read on Balance transactions, Charges, Customers, Disputes, Payment methods, Payouts, and Products (Core); Read on Coupons, Credit notes, Invoices, Prices, and Subscriptions (Billing); Read on Connect (if the account uses it); and Write on Webhooks so PostHog can create the real-time sync webhook (optional only if the user will add that webhook manually later). Link the user to https://posthog.com/docs/cdp/sources/stripe#option-1-restricted-api-key-recommended for the exact dashboard steps. Stripe has no URL parameter that pre-selects these scopes when creating a key — don't imply one exists or invent a deep link for it. Tell the user to paste only the key value, with no surrounding text or whitespace. ## Many `in-cli` sources: work through them one at a time