# What is a Stripe restricted key?

> A Stripe restricted key is an API key with only the permissions you pick. How to create a read-only key for subscriptions and charges, safely.

**Stripe restricted key**: A Stripe restricted key is an API key limited to the permissions you choose, such as read-only access to subscriptions and charges.

A restricted key is a Stripe API key that only has the permissions you choose. It is the safe way to let a tool read your numbers without being able to move money.

## The short definition

Stripe has three kinds of API keys: a **publishable key** for your checkout page, a **secret key** that can do everything, and **restricted keys** that can do only what you allow. Restricted keys start with `rk_live_` (or `rk_test_` in test mode).

For each resource, such as Charges, Customers or Subscriptions, you choose **None**, **Read** or **Write**.

## Creating a read-only key

1. In the Stripe Dashboard, open **Developers**, then **API keys**.
2. Choose **Create restricted key**, then **Providing this key to a third-party application**.
3. Enter who it is for, like "makerhandle" and https://makerhandle.com.
4. Tick **Customize permissions for this key** and set **Subscriptions** and **Charges** to **Read**. Leave everything else at **None**.
5. Create the key and copy it into the tool.

Menu names occasionally change; Stripe's docs have the current path.

## Why it matters

A secret key in the wrong hands can issue refunds, create charges and change payout settings. A read-only restricted key cannot do any of that. If it ever leaked, the worst case is someone seeing figures you were publishing anyway.

You can delete a restricted key at any time in Stripe, which ends access immediately.

## How makerhandle uses it

makerhandle only accepts restricted keys and rejects full secret keys. It checks the key's permissions before saving, encrypts it at rest and never shows it again. It reads subscriptions and charges to calculate [MRR](https://makerhandle.com/glossary/mrr). See [Stripe MRR](https://makerhandle.com/features/stripe-mrr) and [how to show verified MRR](https://makerhandle.com/blog/how-to-show-verified-mrr).

## Sources

- [Stripe docs: API keys and restricted keys](https://docs.stripe.com/keys)

## Questions

### What does a restricted key start with?

rk_live_ for live mode and rk_test_ for test mode.

### Can a read-only restricted key refund payments?

No. Refunds need write access, which a read-only key does not have.

### How do I revoke a restricted key?

Delete or roll it in the Stripe Dashboard under Developers, API keys.

### Which permissions does makerhandle need?

Read access to Subscriptions and Charges.

---

Source: https://makerhandle.com/glossary/stripe-restricted-key
makerhandle: makerhandle is a link in bio for makers and founders: every project with its status and revenue verified from Stripe, Paddle and more.