Protect Secrets When Payments Fail
The moment a payment intent fails, the customer's repository is automatically removed from your organization secrets—stopping their deployments from accessing environment variables and sensitive data without paying, protecting your infrastructure and revenue.
Trigger
Payment Intent Failed Trigger
Triggered when a payment intent fails in Stripe
Action
Add selected repository to an organization secret
Adds a repository to an organization secret's access list when the secret's visibility is 'selected'; this operation is idempotent.
Why this helps
Payment fails but unpaid deployments keep running with full access to secrets; data leak risk, compliance issue, unpaid customer exploits access.
- Unpaid customers lose secret access instantly—no data leaks
- Deployment security is automatically enforced tied to payment status
- Clear audit trail of secret access revocations linked to payment events
- Reduces security risk from manually tracking payment-to-access relationships
Setup
Build it in a few focused steps.
- 1Connect Stripe and GitHub to Notis.
- 2Create an automation: 'When a payment intent fails, remove the repository from the [SECRET_NAME] organization secret's access list'.
- 3Tell Notis how to identify which repository to remove: 'remove repo owned by this customer' or 'remove repos labeled customer:[id]'.
- 4Set Slack notifications so you see each revocation; test with a failed payment in Stripe sandbox.
Questions about this workflow
Will this only revoke secrets or also stop the deployment?
Only secrets are revoked. If you also want to cancel deployments, create a separate automation: 'cancel workflows on payment failure'. Notis handles both.
What if I want a grace period before revoking?
Tell Notis: 'wait 24 hours then revoke secret access'. Notis will give time for payment retry before revoking.
Can I restore access if the payment succeeds later?
Yes. Create a companion automation: 'when payment succeeds, restore the repository to the secret'. Notis handles both revoke and restore.
When this happens · Trigger
Do this · Action
Supported Triggers and Actions
Notis builds workflows that link Stripe to GitHub. A trigger fires from one place; an action lands in another.
Stripe triggers
GitHub actions
Charge Failed Trigger
Triggered when a direct charge fails in Stripe's legacy Charges API
Accept a repository invitation
Accepts a pending repository invitation that has been issued to the authenticated user.
Checkout Session Completed Trigger
Triggered when a checkout session is completed in Stripe
List repositories starred by the authenticated user
Deprecated: lists repositories starred by the authenticated user, including star creation timestamps; use 'list repositories starred by the authenticated user' instead.
Invoice Payment Succeeded Trigger
Triggered when an invoice payment is successful in Stripe
List stargazers
Deprecated: lists users who have starred a repository; use `list stargazers` instead.
Payment Intent Failed Trigger
Triggered when a payment intent fails in Stripe
Star a repository for the authenticated user
Deprecated: stars a repository for the authenticated user; use `star a repository for the authenticated user` instead.
Product Created Trigger
Triggered when a product is created in Stripe
Add email for auth user
Adds one or more email addresses (which will be initially unverified) to the authenticated user's github account; use this to associate new emails, noting an email verified for another account will error, while an existing email for the current user is accepted.
Subscription Added Trigger
Triggered when a subscription is added in Stripe
Add app access restrictions
Replaces github app access restrictions for an existing protected branch; requires a json array of app slugs in the request body, where apps must be installed and have 'contents' write permissions.
Subscription Deleted Trigger
Triggered when a subscription is deleted in Stripe
Add a repository collaborator
Adds a github user as a repository collaborator, or updates their permission if already a collaborator; `permission` applies to organization-owned repositories (personal ones default to 'push' and ignore this field), and an invitation may be created or permissions updated directly.
Add a repository to an app installation
Adds a repository to a github app installation, granting the app access; requires authenticated user to have admin rights for the repository and access to the installation.
Connect any two apps with Notis in the middle.
Not just Stripe and GitHub. Any combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7 days free trial with 20$ free usage included.
No card. Works with personal or business GitHub.