AllRev

Provider setup guides

Every connection to AllRev is a read-only key you create yourself, in your provider's own dashboard, with exactly the permissions listed here — these are the same lists the app's connect wizard shows, ticked off one by one. AllRev refuses a key that could move money, and tells you which one to make instead.

Whichever provider you start with, the key is sealed into your machine's keychain and used for read requests to that provider's API host only — the full story of what is sent where is on the privacy page. Shopify, WooCommerce, Creem and ThriveCart are planned for v1.1.

Stripe

Cards, subscriptions, invoices and payouts.

Credential
restricted key (begins rk_)
Created at
dashboard.stripe.com/apikeys
API host
api.stripe.com
Fees & payouts
Both reported — net is exact, and payouts can be reconciled against your bank.
  1. Check the account. Sign in to the Stripe Dashboard and confirm the account name in the top-left corner is the one whose revenue you want to see. Several Stripe accounts? Connect them one at a time — each gets its own key and its own row.
  2. Open Developers → API keys. The Developers link is at the top right; API keys is the first tab. Some accounts still show a Developers item in the left sidebar instead — either way you want the page titled “API keys”.
  3. Create a restricted key. Scroll past “Standard keys” — that is where the secret key lives, and AllRev will not accept one — down to “Restricted keys”, and click Create restricted key.
  4. Name it “AllRev (read-only)” so you recognise it in six months, and leave every permission on None to start with.
  5. Set exactly the nine permissions below to Read, and nothing else. The list is long because a revenue dashboard has to reconcile fees, refunds and payouts — but every one of them is Read, and none of them can move money.
  6. Create, reveal, copy. The key begins rk_live_ — or rk_test_ if the dashboard's test-mode switch is on, which is fine for a dry run but will show you test data, not real revenue.
  7. To cut AllRev off, revoke the key on this same page. Nothing else about your Stripe account changes.

Permissions to set to Read

  • Charges
  • PaymentIntents
  • Customers
  • Subscriptions
  • Invoices
  • Balance transactions
  • Payouts
  • Disputes
  • Products and Prices

Read is the only level AllRev asks for. A key with these permissions cannot create a charge, issue a refund, change a price or read your bank details.

Paddle

Merchant of record — Paddle handles VAT and invoicing.

Credential
read-only API key (begins pdl_)
Created at
vendors.paddle.com/authentication-v2
API host
api.paddle.com
Fees & payouts
Both reported — with one honest seam, below.
  1. Open Developer tools → Authentication and, under API keys, click New API key.
  2. Name it “AllRev (read-only)”.
  3. Set the key's permissions to read-only, enabling only the three below. Paddle keys carry per-resource read/write toggles; leave every write toggle off.
  4. Copy the key. A live key begins pdl_live_ and a sandbox key begins pdl_sdbx_ — AllRev reads the mode from the prefix and labels the account accordingly. Sandbox keys are created in Paddle's sandbox dashboard, not this one.

Permissions to enable

  • Transactions — read
  • Subscriptions — read
  • Customers — read

Read-only on three resources. Paddle remains the merchant of record; AllRev never issues an invoice or a refund.

The honest seam: Paddle charges the buyer in one currency and settles to you in another, and reports the fee in the settlement currency. When the two differ, AllRev shows that transaction's fee as not reported rather than guessing an exchange rate — so net for those rows can be higher than Paddle's own earnings figure.

Lemon Squeezy

Merchant of record for digital products.

Credential
API key (a long JWT beginning eyJ)
Created at
app.lemonsqueezy.com/settings/api
API host
api.lemonsqueezy.com
Fees & payouts
Neither is reported — see the note below.
  1. Open Settings → API and click the + button to create a new API key.
  2. Name it “AllRev”.
  3. Copy it straight away — Lemon Squeezy shows the key once and never again. It looks like a long JWT (it starts with eyJ); that is the right thing.

What AllRev reads

  • Orders
  • Subscriptions
  • Customers

Lemon Squeezy does not offer scoped keys: this key can do anything your account can, and that is their limitation, not our choice. AllRev only ever makes the three read calls listed above — and you can revoke the key from the same page the moment you stop using AllRev.

Lemon Squeezy publishes no per-transaction fee on any read endpoint and has no payouts API, so net revenue for this account is gross minus tax, with fees shown as “not reported by Lemon Squeezy” — never as zero.

Polar

Open-source-friendly checkout and subscriptions.

Credential
organization access token (begins polar_oat_)
Created at
polar.sh/settings → your organization's Developers page
API host
api.polar.sh
Fees & payouts
Neither within these scopes — see the note below.
  1. Open your organization's Settings → Developers page.
  2. Click New token, name it “AllRev”, and choose an expiry you are happy to renew.
  3. Tick only the four read scopes below, then create the token. Polar lists scopes as checkboxes; every unticked box is a thing AllRev cannot do.
  4. Copy the token — it begins polar_oat_. Sandbox and live tokens are spelled identically, so AllRev will ask which one you copied before checking it: check whether you copied it in your live organisation or the sandbox one. Live is the common case.

Scopes to tick

  • orders:read
  • subscriptions:read
  • customers:read
  • products:read

Four read scopes, named exactly as Polar names them. No write scope, no payouts scope: a token with these cannot move money or read what pays you out.

Because the least-privilege scopes do not include fees or payouts, this account's net is gross minus tax minus refunds, with fees shown as “not reported by Polar” — the alternative is asking for a broader token, which is a worse trade.

Gumroad

One-off sales and memberships.

Credential
access token
Created at
app.gumroad.com/settings/advanced → Applications
API host
api.gumroad.com
Fees & payouts
Fees reported; payouts deliberately not requested — see below.
  1. Open Settings → Advanced → Applications and create an application called “AllRev”. The redirect URI is not used; any value will do.
  2. On the application, tick view_sales and nothing else, then generate an access token. Leave edit_products and view_profile off.
  3. Copy the access token.

Scope to tick

  • view_sales

One scope. It can list your sales; it cannot edit a product, change a price or see your profile settings. Gumroad's payout records sit behind a separate view_payouts scope AllRev deliberately does not ask for.

RevenueCat

App Store and Play Store subscriptions.

Credential
V2 secret API key (begins sk_)
Created at
app.revenuecat.com/settings/api-keys (Project settings → API keys)
API host
api.revenuecat.com
Also needed
The project id, from the same settings page
  1. Open Project settings → API keys for the project you want. RevenueCat's v2 keys are per-project: a key for one app cannot read another.
  2. Create a new V2 secret key named “AllRev”.
  3. Grant it the five read permissions below and no write permissions.
  4. Copy the key, then copy the project id from the same settings page — AllRev asks for both. The project id sits above the API keys list and is not a secret.

Permissions to grant

  • project_configuration:projects:read
  • project_configuration:products:read
  • customer_information:customers:read
  • customer_information:subscriptions:read
  • customer_information:purchases:read

Read on the project's configuration and on customers, subscriptions and purchases — nothing else. A RevenueCat secret key is powerful by default, so granting only these five matters more here than anywhere else.

Payouts are not part of this connection: the App Store and Play Store pay you directly, so there is nothing for RevenueCat to report.

Dodo Payments

Merchant of record for global digital sales.

Credential
API key (read-only)
Created at
app.dodopayments.com/developer/api-keys
API host
live.dodopayments.com (test keys: test.dodopayments.com)
Fees & payouts
Payouts reported; fees and tax are not — see the note below.
  1. Check the live/test switch at the top of the dashboard first — a key only works in the mode it was created in.
  2. Open Developer → API keys and create a key named “AllRev” with “Enable write access” left unchecked.
  3. Copy the key. When you paste it into AllRev, the app asks which environment it is for — live or test — because the key's spelling does not say.

The whole choice

  • Read-only key — leave “Enable write access” off

Dodo does not scope keys per resource: a read-only key can list your payments, subscriptions, customers, products and payouts, and cannot create or modify any of them. AllRev never creates a payment or a subscription.

Dodo reports no per-transaction fee or tax on its list endpoints, so net for this account is gross minus refunds, with fees shown as “not reported by Dodo Payments”. Payout records are fetched and reconcilable.