Last updated: August 14, 2026

Your Stripe API key is a credential that authenticates your account to Stripe - it is how Stripe verifies that a request is coming from you. 

If an unauthorized party obtains your key, they can impersonate you and carry out fraudulent activity on your account (or platform) that can result in financial losses to you and your customers.

We want to help you keep your account safe. This notice outlines recommended steps for securing your API keys and reminds you that, under your agreement with Stripe, you bear responsibility for any losses arising from a key compromise. Taking these precautions now can help you avoid that risk.

API key security and steps you should take

Your API keys are so sensitive that even Stripe employees cannot access them. However, we want to help you keep them secure, and we’ve shared best practices below to make that as straightforward as possible. That said, because keys live and operate within your own environment, how they're stored, used, and shared is ultimately in your hands. If a key is ever exposed through your systems, code, or a third-party integration, it could allow unauthorized access to your account, which is why we encourage reviewing the guidance below and reaching out to Stripe support if you ever have concerns about a key's security.

Stripe publishes detailed guidance on how you can best manage API key security. We recommend reviewing to try and avoid any incidents occuring: 

• API key best practices - covers access controls, key rotation, and monitoring

Additionally, Stripe recommends using Restricted API Keys (RAKs) rather than broad secret keys whenever possible. Unlike secret keys, which carry full account access, RAKs can be scoped to only the specific API resources and actions your integration actually needs — limiting the potential impact if a key is ever exposed or compromised. You can create a separate restricted key per service, environment, or third-party integration, granting each only the minimum permissions required. RAKs also support additional controls such as IP allowlisting, expiration, and scheduled rotation to further reduce your exposure window. For full details on creating and configuring restricted API keys, see Restricted API Keys.

What a compromised key allows

Anyone who gets access to your API key can take any action that the key is configured to allow. This can include:

• creating charges or subscriptions;
• issuing refunds;
• accessing customer data;
• changing payout destinations on connected accounts;
• creating payouts; and
• transferring funds between your platform and connected accounts.

When a key on a platform account is compromised, the impact can extend to connected accounts and the consumers they serve, not only to the platform itself.

Your responsibilities

Under your Stripe Agreements, you are responsible for maintaining the security of your API keys and ensuring they are used only by authorized parties. As noted above, the storage and handling of keys within your own environment falls outside of Stripe’s control. 

As the account holder, you're in the best position to protect your account — and with that comes ownership of any losses that result from unauthorized activity tied to a compromised API key, whether on your own account or any connected accounts on your platform. This covers situations such as:

• unauthorized access to your systems, credentials, or Stripe account;
• tampering with or compromise of your keys; or
• gaps in anti-fraud or data security measures within your environment.

We know that's a lot to manage, and the best practices in this policy are designed to help you address each of these areas proactively.

If a key is compromised

If you believe a key has been compromised, you should act promptly. Stripe provides step-by-step guidance on how to respond:

• Protecting against compromised API keys - covers stopping access, rotating keys, and reviewing account activity

Working with Stripe

Responsibility for losses resulting from API key compromises lies with the account holder, as outlined in your Stripe Agreements. That said, Stripe is committed to supporting our users wherever possible. When individual situations surface opportunities to strengthen security practices, we work collaboratively to help ensure the safety and integrity of Stripe's platform for all users. This is reflected in the responsibilities you agree to in your Stripe Agreements. 

Note: This notice supplements your Stripe Agreements and does not replace them. In the event of any conflict between this notice and the Stripe Agreements, the Stripe Agreements prevail.