API Key

An API key is the credential your application sends with each Stripe request. It tells Stripe which account the call belongs to and what the call may do. Anyone with your secret key can act as your account, so keep it private.

The three key types

Each Stripe key type has its own prefix:

• Publishable key (pk_). Safe to put in client-side code. It can only do low-risk things like collecting card details in the browser. It can't read your data or move money.
• Secret key (sk_). Full access, for server-side code only. Never put it in client code or a public repository.
• Restricted key (rk_). A server-side key limited to the resources you pick when you create it. If it leaks, the damage is limited to those resources.

Test vs live keys

Every key belongs to one mode. Test-mode keys contain _test_ (for example sk_test_...) and only touch test data. Live-mode keys contain _live_ and move real money. A test key can't charge a real customer.

Keeping keys safe

• Store secret keys in environment variables or a secrets manager. Never put them in a browser, a mobile app, or version control.
• Give services that need only part of your account a restricted key.
• Roll (regenerate) a key right away if it is exposed.

Some integrations don't need a key at all. ChargeBell connects through Stripe's OAuth flow with read-only access. It receives your payment events without you sharing a secret key, and it can't move money.