I would output the arguments to the second post_form call just before it occurs.

Bingo! - Thank you very much hippo

That explains what is going wrong...the authorization parameter is missing...

It doesn't explain why it is going wrong.

Using this code:

print "Content-type: text/plain\n\n";

my $headers = {
    'headers'       => {
        'Authorization' => 'Bearer ' . $Site::Variables::stripe_secret
+,
    },
    'agent'         => 'Wayfinder/v3.0',
};

my $sub_id = 'sub_xxxxxx';

print Dumper $headers;
print "\n\n--------------\n\n";

# This line is the culprit...
my $res = $http->post_form("https://api.stripe.com/v1/subscriptions/$s
+ub_id", {}, $headers);

print Dumper $headers;
print "\n\n--------------\n\n";
[download]

I get this output:

$VAR1 = {
          'headers' => {
                         'Authorization' => 'Bearer sk_test_abc123'
                       },
          'agent' => 'Wayfinder/v3.0'
        };


--------------

$VAR1 = {
          'agent' => 'Wayfinder/v3.0'
        };


--------------
[download]

Somehow the $header is being changed during the first call. I see nothing in the documentation for HTTP::Tiny to explain this.

In the short-term I can work around the problem by recreating $header between calls to Stripe. But it's not a very good solution.

I would also try to fix this first

Ordinarily, I would have fixed the API call first. However, the call requires data from the first call in order to work. Hence the need for two calls to the API.

Nothing in the HTTP::Tiny docs but it is in the code:

# line 239
sub post_form {
    my ($self, $url, $data, $args) = @_;
    # ...
    delete $args->{headers};
[download]

The request() method doesn't seem to do this deletion.

...but it is in the code

Well spotted tangent
I'm sure there was a reason for this behaviour but it does seem very odd!

All my calls to Stripe are in a dedicated module and this has now been modified to get around this issue. The headers are cloned to create a deep copy immediately before the API calls and therefore the original headers don't get clobbered. I've done this with all calls in case any future script makes multiple calls for any reason.

use HTTP::Tiny;
use Clone qw(clone);

my $http = HTTP::Tiny->new;
my $headers = {
    'headers'       => {
        'Authorization' => 'Bearer ' . $Site::Variables::stripe_secret
+,
    },
    'agent'         => 'Wayfinder/v3.0',
};

# for each API call
my $head = clone($headers);
my $response = $http->post_form($stripe_api_url, $payload, $head);
[download]