Stripe API keys authenticate requests from your integration, and there are three you'll meet: a publishable key that's safe in front-end code, a secret key with unrestricted access to every Stripe API, and a restricted key that can only do what you allow. Sandboxes and live mode each have their own set, managed on the API keys page in the Dashboard.
Here's the change most guides haven't caught up with. Stripe now recommends restricted keys for most use cases, doesn't recommend secret keys for new ones, and suggests existing integrations move their secret key usage over. The other surprise: in live mode, a key you created yourself is shown once. If you didn't copy it, Stripe can't recover it, so you'll have to rotate or delete it and make another.
The key types and where each belongs
| Key, as of October 2026 | Starts with | Safe to expose? | What it does |
|---|---|---|---|
| Publishable | pk_ | Yes | Identifies your account for Stripe.js, Elements and mobile SDKs and creates tokens or PaymentMethods, but can't create charges or read account data |
| Restricted | rk_ | No | Only the permissions you set; make as many as you like for different parts of your app |
| Secret | sk_ | No | Unrestricted access to all Stripe APIs |
| Organization | sk_org_ | No | Works across several Stripe accounts at once |
Webhook signing secrets aren't API keys. They're per-endpoint secrets your webhook receiver uses to confirm events came from Stripe, and you find them under each endpoint in the Webhooks section, not on the API keys page.
Sandbox keys vs live keys
Sandbox keys start with pk_test_, rk_test_ and sk_test_, and live keys with pk_live_, rk_live_ and sk_live_. Objects in one mode can't be used in the other, so a sandbox product can't be part of a live payment. Stripe suggests a separate general sandbox for new integrations, so settings and data stay apart from live mode. In a sandbox you can always see every key; in live mode you can only reveal keys Stripe created for you, such as a default secret key or one made by a scheduled rotation.
Creating a key
Stripe points you to restricted keys first, so you can assign the exact permissions your integration needs. If your integration needs unrestricted access, this is how you create a secret key:
- On the API keys page, click Create secret key.
- Enter the verification code Stripe sends by email or text message.
- Give the key a name and click Create.
- Click the key value to copy it, then save it somewhere safe. You can't retrieve it later.
- In Add a note, record where you saved it, then click Done.
You can also tag a restricted key as belonging to an autonomous AI agent. It works like any other restricted key, but sensitive actions such as payouts, refunds and account configuration changes need a designated reviewer's approval before they take effect. Stripe calls this the recommended way to give agents access to your account.
Rotating a key without downtime
Rotating revokes a key and generates a replacement that works immediately. Do it if a key's lost or compromised, if someone with access leaves or changes roles, or if your policy needs regular rotation. When you rotate in the Dashboard, the old and new keys both work for up to 7 days, so you can move over gradually.
- Open the overflow menu for the key and select Rotate key.
- Pick an expiry from the Expiration dropdown. Choosing Now deletes the old key straight away.
- Click Rotate API key, copy the new value and save it.
- Add a note saying where it's stored.
- Roll it out to a few servers first, watch the logs, and only expire the old key once its request volume has sat at zero for a while.
If you need longer than 7 days, create a new key manually, migrate, then expire the old one yourself. You can't expire a publishable key. A replacement secret key is always named Secret key, while a rotated restricted key keeps its name.
Access policies and day-to-day protection
Access policies have replaced the old IP address restrictions, and Stripe recommends one on every live mode key. If a request comes from somewhere a key isn't allowed, Stripe blocks it and tells you. An IP policy accepts specific IPv4 addresses or ranges. An Advanced policy can allow chosen ASNs and countries and block anonymous VPNs, public proxies, residential proxies and Tor exit nodes, with every rule combined using AND logic.
- Store keys in your hosting platform's secrets vault, or environment variables if you can't.
- Never put keys in source code or files checked into version control.
- Never send keys by email, chat or other unencrypted channels.
- Rotate keys when people with access leave.
One quirk worth knowing: if a key hasn't been used to create transfers, payouts or payout destinations for over 180 days, Stripe may limit its access to those actions. Choose Restore access from the key's overflow menu to fix it.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Switching to live keys
Toggle the API keys page from sandbox to live mode. Replace pk_test_ with your pk_live_ key in client-side code, which is safe to embed. On the server, remove any hard-coded keys, supply rk_live_ or sk_live_ from your secrets vault and confirm the app still works. If you use webhooks, update each endpoint's URL and copy its new signing secret.
My verdict on Stripe API keys
I'd give every tool or app that touches Stripe its own restricted key with the narrowest permissions it needs, name it clearly, and note where it's stored. Put an access policy on your live keys and rotate when anyone leaves. If you're running a platform, read how Stripe Connect splits responsibility before you hand out keys, and if you're wiring up Stripe Checkout, the publishable key is the only one that belongs in the browser.
Keys are where a lot of AI tool set-ups go wrong: someone pastes a secret key into a no-code app and forgets it. I run AI training and workshops for teams, and help businesses with AI enablement, AI automation and workflow set-up, so the tools you already pay for do more of the work. Most of that work is with SaaS marketing teams and small businesses. Here's how we can work together.
Frequently asked questions
Which Stripe API key is safe to use in front-end code?
Only the publishable key, which starts with pk_. Secret, restricted and organization keys must stay on your server.
Can I see my Stripe secret key again?
In live mode, only if Stripe created it for you. A key you created yourself is shown once and can't be recovered, so rotate or delete it if you lose it.
How long do old and new Stripe keys both work after rotation?
When you rotate in the Dashboard, both keys work for up to 7 days.
Should I use a secret key or a restricted key in Stripe?
Stripe recommends restricted keys for most use cases, because you control their permissions.
Is a webhook signing secret an API key?
No. It's a per-endpoint secret found in the Webhooks section, used to confirm events came from Stripe.
