Per-user-per-month pricing means you pay a fixed amount for each active user every month. The unit price is what one user costs in one month, regardless of how much they use the service. In the example, the unit price shown is $9 per user per month, so that is the per-user monthly price. For context, if there are 5 users, the total would be 5 × $9 = $45 for that month, while the per-user price stays at $9. The other numbers would only apply if the unit price were different, but the example specifies $9.

Understanding the timing of dashboard postings starts with the idea that balance changes are applied in a nightly processing batch. After the end of the day (T+0), fees are accumulated and then a batch runs to move those amounts into the IC+ fee balance. That batching completes over a fixed window, so the net effect appears 48 hours after end of day T+0. In other words, there’s a two-day processing period before those transactions land in the balance, not an immediate posting and not a one-day or three-day delay. If the end of day falls on a weekend or holiday, the posting typically shifts to the next business day, but the standard window remains about two days.

Completing the platform profile is what unlocks Connect initially. This step provides Stripe with the essential details about your business—things like your business type, country, contact information, payout preferences, and any required verification documents. Once the platform profile is finished, Connect features become available for onboarding and managing connected accounts. The other options aren’t about turning on Connect: Radar rules are optional security settings for fraud checks, a payment intent is part of processing a charge, and verifying bank account details relates to payouts and identity checks, not the initial enablement of Connect.

Keeping your API keys secure is the most important aspect of API security because those keys are the credentials that prove your app’s identity to the API and authorize every action it takes. If those keys are exposed, an attacker can impersonate your app, access sensitive data, create or modify resources, and incur real-world costs, regardless of other protections in place. The keys themselves are the gateway; once they’re leaked, other safeguards can be bypassed or overwhelmed. Encrypting data at rest matters for protecting stored information, but it doesn’t stop misuse if someone has valid credentials to access the API. Rate-limiting helps deter abuse and protect resources, yet it won’t stop someone who already has legitimate keys from making requests. Regularly updating dependencies reduces software vulnerabilities, but that doesn’t address the risk of stolen credentials. To keep keys secure, avoid putting them in client-side code, use secret management tools or environment variables, and never commit them to version control. Use separate keys for different environments (development, staging, production), rotate keys regularly, and apply least-privilege restrictions or scoped keys when possible. Monitor usage for unusual activity and respond quickly to any suspected compromise. By protecting the keys themselves, you establish a strong foundation for securing access to your API and the data it handles.