What is a Stripe restricted key?

The short definition

Stripe has three kinds of API keys: a publishable key for your checkout page, a secret key that can do everything, and restricted keys that can do only what you allow. Restricted keys start with rk_live_ (or rk_test_ in test mode).

For each resource, such as Charges, Customers or Subscriptions, you choose None, Read or Write.

Creating a read-only key

1. In the Stripe Dashboard, open Developers, then API keys.
2. Choose Create restricted key, then Providing this key to a third-party application.
3. Enter who it is for, like "makerhandle" and https://makerhandle.com.
4. Tick Customize permissions for this key and set Subscriptions and Charges to Read. Leave everything else at None.
5. Create the key and copy it into the tool.

Menu names occasionally change; Stripe's docs have the current path.

Why it matters

A secret key in the wrong hands can issue refunds, create charges and change payout settings. A read-only restricted key cannot do any of that. If it ever leaked, the worst case is someone seeing figures you were publishing anyway.

You can delete a restricted key at any time in Stripe, which ends access immediately.

How makerhandle uses it

makerhandle only accepts restricted keys and rejects full secret keys. It checks the key's permissions before saving, encrypts it at rest and never shows it again. It reads subscriptions and charges to calculate MRR. See Stripe MRR and how to show verified MRR.