{"record":{"id":"5da2022d2a2a496a","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-5da202","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/plugin-stripe/src/routes/rest.ts","lineNumber":28,"sourceCode":"  pluginConfig: StripePluginConfig\n  req: PayloadRequest\n}): Promise<any> => {\n  let responseStatus = 200\n  let responseJSON\n\n  const { pluginConfig, req } = args\n\n  await addDataAndFileToRequest(req)\n\n  const requestWithData = req\n  const { data, payload, user } = requestWithData\n\n  const { stripeSecretKey } = pluginConfig\n\n  try {\n    if (!user) {\n      // TODO: make this customizable from the config\n      throw new Forbidden(req.t)\n    }\n\n    responseJSON = await stripeProxy({\n      stripeArgs: data?.stripeArgs, // example: ['cus_MGgt3Tuj3D66f2'] or [{ limit: 100 }, { stripeAccount: 'acct_1J9Z4pKZ4Z4Z4Z4Z' }]\n      stripeMethod: data?.stripeMethod, // example: 'subscriptions.list',\n      stripeSecretKey,\n    })\n\n    const { status } = responseJSON\n    responseStatus = status\n  } catch (error: unknown) {\n    const message = `An error has occurred in the Stripe plugin REST handler: '${JSON.stringify(\n      error,\n    )}'`\n    payload.logger.error(message)\n    responseStatus = 500\n    responseJSON = {\n      message,","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/plugin-stripe/src/routes/rest.ts#L10-L46","documentation":"Thrown by the Stripe plugin's REST endpoint handler (`stripeREST`) as a `Forbidden(req.t)` when the request has no authenticated `user`. The message is the i18n translation key for 'You are not allowed to perform this action.' — the default `Forbidden` text. Any client hitting the Stripe proxy endpoint without a session gets this 403.","triggerScenarios":"Calling the Stripe REST proxy endpoint (`/api/stripe` or whatever path the plugin mounts) without a logged-in Payload user; expired session cookie; the endpoint hit from a server-to-server script that did not set a Cookie/Authorization header.","commonSituations":"Frontend calling the Stripe proxy before login completes; cookie blocked by SameSite/secure policy; a cron/background job assuming the endpoint was public; proxying a test request from Postman without copying the session cookie.","solutions":["Ensure the client is authenticated (valid session cookie or Authorization header) before calling the endpoint","If server-to-server, pass a Payload API key or perform login first to obtain a session","If you genuinely need anonymous Stripe access, mount a custom route with its own auth rather than relying on this guarded endpoint"],"exampleFix":"// before — no credentials\nawait fetch('/api/stripe', { method: 'POST', body: JSON.stringify({ stripeMethod: 'customers.list' }) })\n// after — include the session cookie / API key\nawait fetch('/api/stripe', {\n  method: 'POST',\n  credentials: 'include',\n  headers: { 'Content-Type': 'application/json', Authorization: `users API-Key ${apiKey}` },\n  body: JSON.stringify({ stripeMethod: 'customers.list', stripeArgs: [{ limit: 10 }] }),\n})","handlingStrategy":"validation","validationCode":"// Ensure a user session exists before calling the Stripe proxy\nif (!currentUser) { await login(); }\nawait fetch('/api/stripe', { method: 'POST', credentials: 'include', body: JSON.stringify({ stripeMethod, stripeArgs }) })","typeGuard":null,"tryCatchPattern":"const res = await fetch('/api/stripe', { method: 'POST', credentials: 'include', body })\nif (res.status === 403) {\n  // session missing or expired — re-authenticate, then retry\n  await relogin()\n  return fetch('/api/stripe', { method: 'POST', credentials: 'include', body })\n}","preventionTips":["Gate the Stripe-proxy UI on an authenticated session","Send `credentials: 'include'` (or an API key) on every call to the endpoint","For server-to-server use, perform a login flow or pass a Payload API key"],"tags":["stripe","rest","authentication","forbidden","authorization"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}