Payments Preflight · Check 5 of 15
Use restricted API keys where you can
Restricted API keys (rk_) limit what a key can do. Use them for scripts, background jobs, AI agents and third-party tools instead of your full secret key.
What it is
A restricted API key lets you choose which Stripe API resources a key can read or write. Stripe recommends them for keys you give to AI agents.
Why it matters
A leaked full secret key can do almost anything on your account. A restricted key limits the damage to the permissions you granted.
How to check
- List every place your secret key is used: app server, cron jobs, scripts, analytics tools, MCP servers, agents.
- For each one, ask whether it needs write access to everything.
How to fix it
- Create a restricted key in the Dashboard per use, with only the permissions it needs.
- Name keys by purpose so you can roll one without breaking the others.
- Keep the full secret key only where it is really needed, usually your main server.
Prompt for your AI coding tool
Paste into Cursor, Claude Code, Lovable or similar. Review the diff before you accept it.
List every place in this repo and its config that uses a Stripe secret key, and for each one list the Stripe API resources it actually calls and whether it reads or writes. I will use this to create restricted API keys with the minimum permissions. Do not change any keys.
Sources
- Restricted API keys Stripe docs
- API keys Stripe docs
Related checks
Sponsor this page: get in touch.