Add the ability to set extended spend request expiration - #255
Conversation
Mirrors the mint PR (stripe-internal/mint#2484603) that lets allow-listed OAuth clients request a spend request expiration up to 7 days out instead of the default 12 hours, for extended/repeat-use agent scenarios. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Committed-By-Agent: claude
Most OAuth clients aren't allow-listed for the server-side flag; leaving it documented in SKILL.md/README.md/schema descriptions would prompt general agents to try it and hit a 400. The flag stays functional (same as the existing `approve` field) but drops its description so it no longer shows up meaningfully in --schema/--llms-full. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Committed-By-Agent: claude
| .describe( | ||
| 'Metadata key:value pair (repeatable). Attaches arbitrary string data to the spend request. Max 50 keys, key <= 40 chars, value <= 500 chars. Example: "order_id:ord_123"', | ||
| ), | ||
| expiresAt: z.coerce.number().int().optional().describe(''), |
There was a problem hiding this comment.
can we add a description? is it seconds since epoch?
There was a problem hiding this comment.
I think we're intentionally leaving it undocumented since it's only supported by certain integrations/clients, but will let @jlau-stripe confirm
There was a problem hiding this comment.
yup! I intentionally left it undocumented because only specific clients can extend expiration at this moment
There was a problem hiding this comment.
but in this specific case I should still describe what the unit is. Will update!
There was a problem hiding this comment.
yea, it'll still show up when they run --help etc., so might as well tell it the right format
kreese-stripe
left a comment
kreese-stripe
left a comment
There was a problem hiding this comment.
one non-blocking comment
| - `--approval-detail` — optional JSON object (MCP/agent) or JSON string (CLI) with approval details for delegated flows. Required fields: `approved_at` (unix timestamp int), `approval_method` (`click`|`programmatic`|`voice`), `app_name`, `external_user_id`. Optional: `ip_address`, `user_agent`, `device_type` (`mobile`|`web`), `agent_log_id`, `external_user_name`, `external_session_id`, `authentication_method` (`biometric_face`|`biometric_fingerprint`|`passkey`). Sent as `approval_details` in the API request body. | ||
| - `card` credentials include `billing_address` (name, line1, line2, city, state, postal_code, country) and `valid_until` (ISO date string — when the card expires/stops working) | ||
| - `--output-file <path>` on `retrieve` or `create` writes full card credentials to a local file (0600 permissions) and redacts card data in stdout. `--force` allows overwriting an existing file. | ||
| - `create` also accepts an undocumented `--expires-at <unix_seconds>` to override the default 12-hour spend request expiration (3 hours to 7 days in the future). It's deliberately excluded from `--schema`/`--llms-full` output and from README/SKILL.md: it's gated to an allow-list of OAuth clients server-side, and most callers get a 400 (`"expires_at is not supported for this client"`) if they try it — don't document or suggest it to general agents. |
There was a problem hiding this comment.
I know this requires a backend change, but I wonder if we should make this a delta rather than an absolute timestamp - I remember hearing that agents have a hard time generating these timestamps as opposed to specifying something like "5 mins"
There was a problem hiding this comment.
I tested it a couple times and don't seem to have issues with this
There was a problem hiding this comment.
I will keep it as is and update if we run into problem
Bare field with no description gave zero signal, but agents seeing an undocumented integer field could just as easily guess wrong (e.g. milliseconds). Clarifying the unit alone doesn't explain the gating or bounds, so it stays unlikely to be tried speculatively. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Committed-By-Agent: claude
CI was failing pnpm biome check on the line-length wrap for the one-line describe() call added in 1b6021f. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Committed-By-Agent: claude
4 participants
as titled