These five filters were introduced with the 26.19.1 security hardening. Each one receives the plugin’s own deny-by-default decision as its first argument; your callback can widen (or further restrict) it. Loosen them only when you understand what the guard protects.

mam_stripe_user_can_manage

apply_filters( 'mam_stripe_user_can_manage', bool $allowed, int $user_id );

The plugin’s “store manager” check. Default: the user (MAM app user, falling back to the logged-in WP user) has the manage_woocommerce capability. Gates:

• direct admin-ajax invocation of the vendor approval scan (mam_stripe_approved_vendors);
• the always-allowed path of the Connect refresh flow (see next filter).

// Let users with a custom marketplace role manage Stripe operations too
add_filter( 'mam_stripe_user_can_manage', function ( $allowed, $user_id ) {
    return $allowed || user_can( $user_id, 'manage_marketplace' );
}, 10, 2 );

mam_stripe_can_refresh_connect

apply_filters( 'mam_stripe_can_refresh_connect', bool $allowed, int $vendor_id, string $account_id );

Decides whether the expired-link refresh endpoint (refresh_stripe_connect) may mint a fresh onboarding session when the one-time state token is missing or expired. Default allows only:

• a vendor/account pair the site already knows — the acct_… id stored on that vendor, or (first onboarding, nothing stored yet) an account this site itself created via enrollment; or
• a store manager (per mam_stripe_user_can_manage).

Everything else is refused with “Not authorized”. A live state token bypasses this filter entirely (the session simply resumes from the server-side payload).

// Example: temporarily allow refreshes for one specific vendor during a support case
add_filter( 'mam_stripe_can_refresh_connect', function ( $allowed, $vendor_id, $account_id ) {
    return $allowed || ( 42 === $vendor_id && str_starts_with( $account_id, 'acct_' ) );
}, 10, 3 );

mam_stripe_allowed_redirect

apply_filters( 'mam_stripe_allowed_redirect', bool $allowed, string $url );

Whitelist for the browser redirect at the end of the refresh flow. Default: only https:// URLs on stripe.com or a *.stripe.com subdomain. This is the open-redirect guard — widen it only for additional Stripe-controlled hosts.

add_filter( 'mam_stripe_allowed_redirect', function ( $allowed, $url ) {
    $host = wp_parse_url( $url, PHP_URL_HOST );
    return $allowed || 'connect.stripe.example' === $host; // your sandbox proxy
}, 10, 2 );

mam_stripe_transfer_vendor_on_order

apply_filters( 'mam_stripe_transfer_vendor_on_order', bool $vendor_on_order, int $order_id, int $vendor_id );

Inside mam_stripe_connect_transfer: a payout transfer is refused unless the vendor has at least one line item on the order. If your commission model legitimately pays a vendor who has no product line on the order (e.g. a delivery partner or a parent-vendor split), return true for that case.

add_filter( 'mam_stripe_transfer_vendor_on_order', function ( $on_order, $order_id, $vendor_id ) {
    if ( $on_order ) return true;
    $order = wc_get_order( $order_id );
    // allow the delivery vendor recorded on the order
    return $order && (int) $order->get_meta( '_delivery_vendor_id', true ) === $vendor_id;
}, 10, 3 );

The transfer’s other guards (amount ≤ order total, vendor approved, idempotency) still apply.

mam_stripe_connect_account_country

apply_filters( 'mam_stripe_connect_account_country', string $country, string $vendor_email );

The two-letter country code used when creating a vendor’s Stripe Connect account during enrollment. Default 'US'. Non-US platforms (or mixed-country marketplaces, using the vendor email to decide) should set it before vendors enroll — the country of a Stripe account cannot be changed afterwards.

add_filter( 'mam_stripe_connect_account_country', function ( $country, $vendor_email ) {
    return 'CA';
}, 10, 2 );

Related articles

• Recipe: Stripe Connect vendor onboarding
• Hook: mam_stripe_connect_transfer
• Hook: mam_stripe_approved_vendors

Metadata