How to create a read-only Stripe restricted key
A Stripe restricted key is an API key that can only do what you allow, so a key set to Read can show your revenue but can never charge, refund or pay out. Create one in Stripe under Developers → API keys → Create restricted key, set the permissions you need to Read and leave the rest on None.
Step by step
- Sign in to the Stripe Dashboard and make sure you are in live mode (the Test mode switch is off).
- Open Developers → API keys.
- Under Restricted keys, click "Create restricted key" and give it a name you will recognise, such as "CountDeck".
- Set only the permissions below to Read. Leave every other permission on None.
- Click Create key. Stripe may ask for two-step verification, then shows the key once: it starts with rk_live_.
- Copy it and paste it into the app. Never paste your secret key (sk_live_).
Which permissions to set to Read
| Permission | What CountDeck shows with it |
|---|---|
| Charges | Revenue, Latest sales |
| Customers | New customers |
| Invoices | Revenue |
| Subscriptions | MRR, Active subscriptions, Churn (30 days) |
| Products and prices | MRR |
| Events | Latest sales |
What CountDeck does with the key
- Refuses secret keys (sk_) and any key that can write, with a message saying which permission to switch to Read.
- Encrypts the key on our servers and never shows it again, not even to you.
- Reads totals only. It never sees full card numbers.
- Stops the moment you delete the key in Stripe or remove it in the app.
Questions
Is it safe to give an app a Stripe API key?
Give a restricted key with Read permissions only, never your secret key. A read-only key cannot move money or change anything, and you can delete it in Stripe at any time.
What is the difference between a secret key and a restricted key?
A secret key (sk_live_) can do everything on your account, including refunds and payouts. A restricted key (rk_live_) can only do what you set, permission by permission.
How do I revoke a restricted key?
In Stripe, open Developers → API keys, find the key under Restricted keys, and delete or roll it. Apps using it stop working right away.
Why does Stripe only show the key once?
For security. If you lose it, delete it and create a new one.
Can I use a test-mode key?
A test key (rk_test_) only sees test payments, so your numbers would be fake. Create the key in live mode.
