Never Paste Your Stripe Secret Key Into a Postcard Tool

You sign up for a tool that promises advertisers can pay you online. Somewhere in the setup there is a screen headed Payments, and it asks you to do four things: open your Stripe dashboard, find your API keys, click Reveal next to the secret key, and paste it into a box.

It looks like connecting an account. It is not. It is handing over the account.

Before you do it on any tool — ours is not the only one you will be asked about — here is what that key is, in Stripe’s own words, and the two questions that tell you whether a vendor has built the payments side properly or cheaply.

What a secret key actually is

Stripe publishes a table of its key types. Against the secret key, the column headed Safe to expose says No, and the description reads:

API key that has unrestricted permissions on all Stripe APIs. Because you can’t limit their permissions, we don’t recommend using secret keys for new use cases.

Unrestricted permissions on all Stripe APIs means, concretely, that whoever holds that key can:

• charge any customer in your account, for any amount
• issue refunds, in full or in part, to anyone
• read every payment, customer, email address and payout you have ever taken
• change where your payouts go and how often they run
• create further API keys

There is no read-only version of a secret key. There is no “just for checkout” version. That is the entire point of the word unrestricted.

Stripe’s guidance on the same page is blunt about handling: “Don’t share keys over email, chat, or other unencrypted channels.” A form on a website is not a category Stripe carved out of that sentence.

“Your keys are encrypted and stored securely” answers the wrong question

Every tool that asks for a key says this, and it is usually true. Encryption at rest is table stakes, not a safeguard, and it addresses a threat that is not the one you have.

The risk is not that somebody reads the key off a hard drive. The risks are:

The vendor can use it whenever they like. Not maliciously — just automatically, in code you cannot see, in ways that were never described to you. A key does not come with a scope. It comes with your whole account.

One breach is everyone’s breach. A database of live secret keys from every operator on a platform is one of the highest-value targets a small SaaS can possibly hold. If it goes, it does not go for one person.

You cannot revoke it from your side without breaking things quietly. There is no “disconnect this app” button in Stripe for a pasted key, because Stripe does not know an app has it. You have to notice, then rotate the key, then find everything else that used it.

It defeats the controls Stripe gives you. Stripe lets you attach access policies to a live key so requests only work from your own servers, and recommends doing it on all live-mode keys. A key living on someone else’s infrastructure cannot have one.

What connecting an account is supposed to look like

Stripe built a whole product for the situation where a platform needs to take payments on your behalf. You click a button, you land on a page hosted by Stripe, you confirm on Stripe’s side, and you come back connected.

The differences that matter to you:

• The platform never sees a key. There is nothing for them to store, and nothing for them to lose.
• You can revoke it yourself, from your own Stripe dashboard, in one click, the day you decide to leave. You do not have to ask them to delete anything.
• The access is scoped and it is auditable. You can see the connection exists, because Stripe shows it to you.
• The money is still yours. Direct is direct either way — this is about the credential, not the destination.

If a tool cannot do this, it is a choice they made. Connecting properly is more work to build than a text box, and the text box ships faster.

The middle ground, in fairness

Stripe also issues restricted keys (rk_), where you pick the permissions yourself. Stripe now recommends these for most server-side uses and suggests migrating existing secret-key integrations onto them.

A tool that asks for a restricted key, and tells you exactly which permissions to grant, has thought about this. It is meaningfully better than asking for sk_live_.

It is still not the same thing. A restricted key with write access to charges and refunds can still move money, you still cannot see the connection from Stripe’s side, and revoking it is still a rotation rather than a button. Treat it as the acceptable version of a compromise, not as equivalent.

And read where the option sits on the page. If the instructions walk you to the secret key and the restricted key is a sentence underneath in smaller type, you can tell which one they expect you to use.

The two questions

Before you connect anything to the account your advertiser money lands in:

1. “Do you use Stripe Connect, or do I paste a key?” One answer means the vendor never holds a credential of yours. The other means they hold all of it. There is no third answer, and any vendor should be able to answer in a sentence.

2. “How do I disconnect you?” If the answer is anything other than “from your Stripe dashboard, whenever you want”, you are the one carrying the risk of the relationship ending badly.

The same applies to PayPal. A REST client ID and secret is the same shape of thing: credentials for your account, sitting on someone else’s server.

If you have already pasted one

Do not panic and do not assume the worst about anybody. Do this instead:

1. Open the API keys page in your Stripe dashboard and rotate the secret key. Stripe keeps the old key working for up to seven days by default, so the tool will not break the instant you click it.
2. Use those seven days to move anything you actually control onto the new key.
3. Check the key’s request logs before you let the old one expire — Stripe shows you every call that was made with it. That is also the honest way to find out what a vendor was doing with it.
4. If the tool is one you intend to keep using, ask them for the restricted-key permissions list and use that instead.

Where we stand, and our stake in saying this

We built the site-first product. What we got wrong for a long time was thinking the page mattered more than what happened when somebody tried to pay on it — so this is not a lecture from people who got the order right the first time.

We also sell a platform that takes payments for operators, which means we are not a disinterested party here. So: we use Stripe Connect, we never ask for your keys, and you can cut us off from your own dashboard without talking to us. You should weigh that knowing exactly why we are the ones telling you about it.

The part that is true regardless of who you buy from: the account your advertisers’ money lands in is the most valuable thing you own in this business. Do not hand out the keys to it because a setup screen asked nicely.

---

Sources: Stripe’s API keys documentation and its guide to restricted API keys, both read on 31 August 2026.