The stripe api key placement is very confusing

[jTiKey]

So, your docs say to put them in .env.
If you do that, the server start showing warnings:

?: (djstripe.I002) Your keys are defined in the settings files and are also in the admin. You can now add and manage them directly from the django admin.
	HINT: We suggest adding STRIPE_TEST_SECRET_KEY and STRIPE_LIVE_SECRET_KEY directly from the Django Admin. And removing them from the settings files.

If I remove them from the .env then the webhook breaks:

   File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/webhooks.py", line 207, in from_request
     stripe_account = StripeModel._find_owner_account(data=data)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/base.py", line 344, in _find_owner_account
     return Account.get_or_retrieve_for_api_key(api_key)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/account.py", line 147, in get_or_retrieve_for_api_key
    apikey_instance, _ = APIKey.objects.get_or_create_by_api_key(api_key)
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/api.py", line 42, in get_or_create_by_api_key
     key_type, livemode = get_api_key_details_by_prefix(secret)
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/api.py", line 28, in get_api_key_details_by_prefix
     raise InvalidStripeAPIKey(f"Invalid API key: {api_key!r}")
 djstripe.exceptions.InvalidStripeAPIKey: Invalid API key: ''`

Software versions

Dj-Stripe version: 2.8.4
Python version: 3.11.8
Django version:4.2.11
Stripe API version: default
Database type and version: postgres 15

[hyusetiawan]

I am having the same problem here, the way it's set up is rather confusing and not pythonic (there should only be 1 way of doing things). This also happens for DJSTRIPE_WEBHOOK_SECRET, do we add it in the settings.py or do we add it through webhook here: https://github.com/dj-stripe/dj-stripe/blob/master/docs/usage/webhooks.md?

[jleclanche]

The settings are deprecated and they're only there for compatibility with older versions. Everything is in database.

[jTiKey]

@jleclanche What is this AI generated response? Do you care to read the whole thing, not only one line? If I used my time to report a bug, why can't you put some effort into reading issues before closing them?

Your docs say to use the settings for the API keys.
The webhook stops functioning if there is no api keys in the settings. If you looks into your source code it literally uses the settings api keys there.

[jleclanche]

@jTiKey The docs are outdated, this is a known issue (#1841) unrelated to this particular issue, sorry for lack of clarity here but please don't be hostile.

In any case, I understand they right now are saying something incorrect on the website - use the in-database api keys and you shouldn't be getting this error. If you are still getting it in that setup, then something else is at play and feel free to reopen.

[jleclanche]

If you looks into your source code it literally uses the settings api keys there.

That part is the legacy compatibility piece of code which creates API keys in database from the settings, if those are set. Make sure they are not set. This code will be gone in 3.0

[jTiKey]

I cannot reopen an issue you closed.

I'm sure they are not set and I'm getting this error:

`File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/webhooks.py", line 207, in from_request
     stripe_account = StripeModel._find_owner_account(data=data)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/base.py", line 344, in _find_owner_account
     return Account.get_or_retrieve_for_api_key(api_key)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/account.py", line 147, in get_or_retrieve_for_api_key
    apikey_instance, _ = APIKey.objects.get_or_create_by_api_key(api_key)
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/api.py", line 42, in get_or_create_by_api_key
     key_type, livemode = get_api_key_details_by_prefix(secret)
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workspace/.heroku/python/lib/python3.11/site-packages/djstripe/models/api.py", line 28, in get_api_key_details_by_prefix
     raise InvalidStripeAPIKey(f"Invalid API key: {api_key!r}")
 djstripe.exceptions.InvalidStripeAPIKey: Invalid API key: ''

[kennell]

@jleclanche What is the reasoning with storing API keys in the DB? This is a rather unusual approach and does not align with security best practices.

[jTiKey]

@jleclanche What is the reasoning with storing API keys in the DB? This is a rather unusual approach and does not align with security best practices.

The ability to have multiple API keys work. But yeah, I'd rather have that as an optional option and let people use the env keys without the db

[abe-101]

For what its worth the docs for the latest version 2.8 is now available at dj-stripe.dev

[abe-101]

Having the API keys in the db allows the application to act on behalf of multiple stripe accounts (multiple API keys)

[jTiKey]

For what its worth the docs for the latest 2.8 is now available at dj-stripe.dev

Seems outdated, since @jleclanche said using .env is obsolete.

[abe-101]

For what its worth the docs for the latest 2.8 is now available at dj-stripe.dev

Seems outdated, since @jleclanche said using .env is obsolete.

Im not saying its up to date

Im simply saying that the docs from version 2.8 is available on the website

Until recently the website only had version 2.5

[kavdev]

Reopening until we have a bugfix or a clear "cannot reproduce"

[kavdev]

See also #2060