How to send Stripe's secret key when making a raw HTTP POST request to Stripe

Question

Because the Stripe .NET nuget package / library is built on v1 of the Stripe API, and since then a few things have changed, I am making a raw HTTP request to a Stripe endpoint to add a new credit card to an existing customer's account.

My question is: how do I send the Stripe secret key? Looking at this CURL request , I assumed that it is sent as a basic authentication header.

So, here's what I did:

var createCardUrl = string.Format(
   "https://api.stripe.com/v1/customers/{0}/sources", 
   stripeCustomerId);

dynamic headers = new ExpandoObject();
headers.Authorization = string.Format("Basic {0}", Constants.StripeSecretKey);

dynamic body = new ExpandoObject();
body.source = stripeToken;

dynamic cardAdditionResult = Http.MakePostRequest(
                              createCardUrl, 
                              headers, 
                              body)
                            .ObjectFromJson();

Where my MakePostRequest is as follows.

public static string MakePostRequest(string url, 
                IEnumerable<KeyValuePair<string, object>> headers = null, 
                string body = null)
{
    var request = (HttpWebRequest)WebRequest.Create(url);
    request.Method = "POST";

    if (headers != null)
    {
        AddHeaders(request, headers);
    }

    if (!string.IsNullOrEmpty(body))
    {
        var data = Encoding.ASCII.GetBytes(body);
        request.ContentType = "application/x-www-form-urlencoded";
        request.ContentLength = data.Length;

        using (var stream = request.GetRequestStream())
        {
            stream.Write(data, 0, data.Length);
        }
    }

    var response = (HttpWebResponse)request.GetResponse();

    var responseString = new StreamReader(response.GetResponseStream()).ReadToEnd();

    return responseString;
}

I receive a 400 (Bad Request) from Stripe. Obviously, I am not sending the Stripe secret key the way I must.

Answer 1

如果你正在使用基本身份验证，Stripe secret api密钥应该是base 64编码，然后有一个:之后（因为它会划分用户名和密码）