Listener Support Stripe Settings REST API

REST endpoints for reading and writing Stripe-mode configuration and non-Stripe donation webhook secrets. All endpoints require manage_options + a valid X-WP-Nonce header.

---

GET /benecaster/v1/listener-support/stripe

Returns the current Stripe-mode configuration and the saved state of the three non-Stripe webhook secrets.

Auth: manage_options + X-WP-Nonce

Response:

{
  "stripe_mode_enabled": true,
  "stripe_publishable_key": "pk_live_...",
  "stripe_secret_set": true,
  "stripe_webhook_secret_set": true,
  "stripe_webhook_url": "https://example.com/wp-json/benecaster/v1/stripe-webhook",
  "donation_webhook_secrets": {
    "kofi_set": true,
    "paypal_set": false,
    "bmac_set": false
  }
}

Field reference:

---

POST /benecaster/v1/listener-support/stripe

Saves Stripe-mode configuration and/or non-Stripe webhook secrets. All fields are optional — omitted fields are left unchanged.

Auth: manage_options + X-WP-Nonce

Request body:

{
  "stripe_mode_enabled": true,
  "stripe_publishable_key": "pk_live_...",
  "stripe_secret_key": "sk_live_...",
  "stripe_webhook_secret": "whsec_...",
  "kofi_webhook_secret": "my-kofi-token",
  "paypal_webhook_secret": "WEBHOOK-ID-FROM-PAYPAL-DASHBOARD",
  "bmac_webhook_secret": "my-bmac-secret"
}

Field reference:

Omit-to-preserve, whitespace-to-clear semantics: For all secret fields, omitting the key from the request body leaves the stored credential unchanged. Sending an empty string or a whitespace-only string clears it. This lets the admin UI load without pre-filling password fields and still preserve secrets the user hasn’t intentionally changed.

Response: The saved state in the same shape as GET /stripe (no plaintext secrets).

Example — save only Ko-fi token, leaving everything else untouched:

{
  "kofi_webhook_secret": "MY-KOFI-VERIFICATION-TOKEN"
}

Example — clear the PayPal webhook ID:

{
  "paypal_webhook_secret": ""
}