PaperTiger.Plugs.Auth (PaperTiger v1.3.0)

Copy Markdown View Source

Authenticates requests using Stripe-compatible API key verification.

Authentication Modes

  • Lenient (default) - Accepts any non-empty Authorization header
  • Strict - Validates key format (sktest, sklive)

Unauthenticated Paths

/health and the browser-facing Checkout, Payment Link, and Billing Portal paths are served without an Authorization header, matching the fact that a real browser never carries one.

Usage

# In router
plug PaperTiger.Plugs.Auth
plug PaperTiger.Plugs.Auth, mode: :strict

Stripe Authentication Format

Stripe uses HTTP Basic Auth with the API key as the username:

Authorization: Bearer sk_test_abc123
# or
Authorization: Basic c2tfdGVzdF9hYmMxMjM6  (base64 of "sk_test_abc123:")

Error Response

{
  "error": {
    "type": "invalid_request_error",
    "message": "You did not provide an API key..."
  }
}