Connecting Ramp to Stacktic

For: a Ramp Admin or Business Owner. Takes about 10 minutes.

What this integration does

Connecting Ramp lets Stacktic see everyone in your Ramp business. When someone leaves, Stacktic can deactivate them in one step. The same connection can also read your Ramp cards, so you can record which tool account each card pays for (see Step 4).

Deactivating a person stops three things: they can't log in to Ramp, can't spend on any card issued to them, and don't get Ramp notifications. It does not close their cards or their spend limits. Those stay on the account (see What deactivation does (and doesn't do)).

To connect, you create a special login for apps in Ramp. Ramp calls this a Ramp API client. You make it under Settings → Developer API. It belongs to your business, not to the person who sets it up, so it keeps working if they leave.

Stacktic needs two values:

There's no host or business ID to fill in. Ramp's Developer API always lives at api.ramp.com. An API client belongs to exactly one Ramp business, so the credential itself says which one. There's nothing else for you to type.

Before you start

• You need to be a Ramp Admin or Business Owner. Only those two roles can create an API client in Ramp. Anyone else gets a "Business not authorized to use this application" error.
• You need access to ramp.com → Settings → Developer API.

Step 1: Create the API client in Ramp

1. Go to ramp.com → Settings → Developer API → Create app.
2. On the app's Configure allowed scopes screen, tick all eight of these:
   • users:read
   • users:write
   • cards:read
   • transactions:read
   • merchants:read
   • receipts:read
   • funds:read
   • funds:write

A scope is one permission the app asks for. If even one of these is missing, Ramp refuses the whole connection. There's no partial connect. Here's what each group is for:

• The first two let Stacktic read your people and deactivate them.
• The next four are read-only. Finance sync uses cards:read to list your cards (see Step 4). The other three are for matching each card's charges to its tool account. That hasn't shipped yet. Stacktic asks for them now so you won't have to redo this connection when it does (see "Why does Stacktic ask for transaction, merchant and receipt scopes?" in the FAQ).
• The last two let a New-tool workflow issue an approved tool its own Ramp card (see "What do the funds scopes do?" in the FAQ).

3. Create the app. Copy the Client ID and Client secret it shows you. Ramp shows the secret once. If you leave the page without copying it, rotate the secret in Ramp to get a new one. You can't recover the old one.

Step 2: Connect in Stacktic

In Stacktic, go to Tools → Ramp → Integration and enter:

• Client ID
• Client secret

Click Connect. Before saving anything, Stacktic does three checks:

• it uses the credential to get a short-lived access pass from Ramp,
• it confirms Ramp really granted all eight scopes, and
• it reads your business's user list to confirm the connection works.

Sometimes Ramp grants the access pass but leaves out a scope. Then Stacktic tells you exactly which one is missing, not a vague failure. You can go back and tick it without guessing.

Step 3: Turn on removal (when you're ready)

Stacktic starts reading your Ramp member list as soon as you connect. Deactivating people during offboarding is a separate switch. It's off until you turn it on, because deactivation is destructive.

That's true even though the API client already has the users:write scope it needs. That scope is required just to connect at all (see Step 1).

When you want Stacktic to deactivate people in Ramp during an offboarding, turn on Automated user removal on the integration.

Step 4: Turn on finance sync (optional)

Finance sync reads your Ramp cards so you can record which tool account each card pays for. If you give each tool its own Ramp card, that link is how Stacktic will later match each charge to the account it paid for.

It uses the connection you just made, so there's nothing new to paste.

1. Go to Settings → Integrations and find the Finance card.
2. Click Turn on finance sync. Stacktic pulls your cards right away, and again every day.
3. Click Manage cards. Cards without a tool account are listed under Unmapped cards. For each one:
   • Confirm: accept Stacktic's suggestion. When a card's name looks like one of your tools ("Looks like Figma · name match"), Stacktic suggests that tool's account. It never links a card on its own.
   • Link…: pick the tool account yourself.
   • Not software: take the card off the list, for example a card for team lunches. You can restore it later.

A card can be linked to more than one account. Stacktic shows that as Ambiguous. It doesn't guess which account each charge belongs to. Several cards can also be linked to the same account.

Turning finance sync off keeps your cards and links. Turning it back on picks up where you left off.

What you'll see

Once you're connected, Stacktic lists everyone in your Ramp business.

• Roles: each person shows the role Ramp's own People screen uses: Owner, Admin, IT admin, Bookkeeper, Auditor, Member, or Guest.
• Guests: people with the Guest role are flagged as external. Ramp uses that role for outside accountants and bookkeepers. They aren't employees, but they do have real access to your spend data.
• Deactivated or suspended people: they're on the list. They still hold a seat, so Stacktic shows them.
• Invited people: anyone who hasn't accepted their invitation yet is left out. They have no access until they do.
• Last activity: this column is empty for everyone. Ramp doesn't share sign-in or activity dates. An empty column means Stacktic wasn't told, not that the person has never used Ramp.

One thing Stacktic can't fully promise: some people are still finishing setup after accepting an invitation. Ramp's user list can't be filtered for them, and Ramp doesn't say whether they appear by default. So Stacktic doesn't treat someone missing from this list as proof they have no Ramp access.

What deactivation does (and doesn't do)

Here's how Ramp describes deactivation: the person can no longer log in, spend on cards, or get Ramp notifications. That's the whole action. It's one request, and nothing else is touched.

Deactivation does not:

• delete their Ramp user record.
• terminate their cards. The cards stop working right away but stay on the account.
• close any spend limits assigned to them.

If Finance needs those closed or the budget taken back, that's a separate step in Ramp itself.

Ramp also won't let you deactivate the business's last remaining Owner. If that's who you're offboarding, give ownership to someone else in Ramp first.

Security notes

• Not tied to a person. The API client belongs to the business, not to the person who created it. It keeps working if that person leaves.
• No built-in expiry. Ramp doesn't show an expiry on an API client's secret. Rotating it is something you choose to do, not something that happens on a schedule. Rotating doesn't mean ticking the scopes again, but you'll need to reconnect Stacktic with the new secret.
• Stored encrypted. Stacktic keeps the Client ID and client secret encrypted. The Client ID is a public label, not a secret, so it shows in full on the connected card. The secret shows only its last 4 characters.
• You can cut it off anytime. Rotate or delete the API client's secret in Ramp and the connection stops working right away.

Troubleshooting

Frequently asked questions

Why does Stacktic ask for transaction, merchant and receipt scopes? Finance sync uses cards:read today. The other three are for matching each card's charges to the tool account it pays for, which hasn't shipped yet. Ramp won't grant part of a set of scopes. If a scope Stacktic asks for isn't ticked on the app, Ramp refuses the whole connection. Asking for these now means you won't have to redo this setup later. Nothing reads them today.

Do I have to give Stacktic write access even if I don't want automatic removal yet? Yes, in the Ramp app. users:write is one of the eight scopes Ramp requires just to allow the connection. Whether Stacktic actually uses that scope to deactivate anyone is a separate switch, Automated user removal. It's off by default, and you control it in Stacktic, whatever the API client is able to do.

What happens to someone's cards and spend limits when they're deactivated? They're not deleted. Their cards stop working right away but stay on the account. Any spend limits assigned to them still exist. Closing those is a separate step your Finance team takes in Ramp.

Can I connect more than one Ramp business? Each connection covers exactly one Ramp business. An API client belongs to one business, and the credential can't be pointed at a different one. If you have more than one Ramp business, create an API client and a Stacktic connection for each.

Will connecting change or delete anything right away? No. Connecting only reads your business's user list. Finance sync only reads your cards. Stacktic deactivates people only during an offboarding, and only after you turn on Automated user removal. A card is issued only by a New-tool workflow with a Ramp card step, after finance approves the amount.

What do the funds scopes do? funds:read and funds:write let a New-tool workflow's Ramp card step give the requester a virtual card for a newly approved tool.

• The card is named for the tool.
• Its limit is the amount finance entered when approving the request in Stacktic.
• Ramp doesn't approve these cards itself. The approval in Stacktic is the approval.
• If Stacktic has to retry, it first looks for the card it already issued for that request. So a retry doesn't issue a second card.
• Stacktic never closes or changes a card it didn't issue.
• The requester is told the card is ready in Ramp. Card numbers never pass through Stacktic.

If your workflows have no Ramp card step, these scopes are never used.

Does Stacktic see who's actually logging in and using Ramp? No. Ramp doesn't report a last sign-in or last-activity date for any user, so that column is always empty here. That's a gap in what Ramp shares, not something Stacktic failed to collect.

See also

• Ramp's guide to API authorization (vendor documentation)