Providers / Stripe

Payments

Stripe API keys and credentials

What every Stripe credential a founder holds does, whether it expires, and what tends to break. Each fact links to Stripe's own docs.

Last checked 2026-11-08 · stripe.com

At a glance

How to rotate the Secret API key (sk_live_ / sk_test_)

1. Open the API keys page in the Dashboard (make sure you are in the right account or sandbox, and in live mode for live keys) Stripe docs
2. Click the overflow menu (⋯) for the secret key you want to rotate and select Rotate key Stripe docs
3. Pick a time from the Expiration dropdown. Choosing Now deletes the old key; choosing a later time keeps it working until then Stripe docs
4. Click Rotate API key, then copy the new key value and store it in your secrets vault. You cannot retrieve it later Stripe docs
5. Deploy the new key to your servers (Stripe suggests trying it on a small subset first and watching your logs), then check the old key's request logs before it expires Stripe docs

Can the old and new key work at the same time? Yes. Stripe says that when you rotate a key in the Dashboard, both the old and new keys work for up to 7 days. Choosing Now as the expiration deletes the old key immediately, so there is no overlap. For longer than 7 days, create a new key manually, migrate, then expire the old one.

Revoking the old one: Rotate with Now, or expire the old key from the overflow menu (⋯) with Expire key. Stripe suggests expiring only after the old key's request volume (View request logs) has been at zero for a few hours or days.

Source: docs.stripe.com/keys, checked 2026-11-09

Does the Secret API key (sk_live_ / sk_test_) expire?

It's up to you: you can set an expiry for the Secret API key (sk_live_ / sk_test_).

What breaks when the Secret API key (sk_live_ / sk_test_) expires

Code using the expired key can no longer make API calls. Stripe says a request with an expired key returns an authentication error, so server calls fail straight away; Workbench request logs show the failing requests.

Other things that often go wrong with Stripe:

• Secret key is expired or rotated with Now, and the server starts returning authentication errors immediately
• Restricted key lacks a permission the integration needs, so calls fail with permission errors
• Webhook signing secret is rolled without updating the receiver, so signature verification fails
• Live key is pasted into client code instead of the publishable key

How to rotate the Restricted API key (rk_live_ / rk_test_)

1. Open the API keys page in the Dashboard and find the key in the Restricted keys list Stripe docs
2. Click the overflow menu (⋯) for the key and select Rotate key Stripe docs
3. Pick a time from the Expiration dropdown. Choosing Now deletes the old key. The replacement keeps the same name as the rotated key Stripe docs
4. Click Rotate API key, then copy the new key value and store it in your secrets vault. You cannot retrieve it later Stripe docs
5. Deploy the new key, then check the old key's request logs before it expires Stripe docs

Can the old and new key work at the same time? Yes. Same as the secret key: rotating in the Dashboard keeps both the old and new key working for up to 7 days unless you choose Now.

Revoking the old one: Rotate with Now, or choose Expire key from the key's overflow menu (⋯). Expiring a key requires creating a new one and updating any code that uses it.

Source: docs.stripe.com/keys, checked 2026-11-09

Does the Restricted API key (rk_live_ / rk_test_) expire?

It's up to you: you can set an expiry for the Restricted API key (rk_live_ / rk_test_).

What breaks when the Restricted API key (rk_live_ / rk_test_) expires

Code using the expired key can no longer make API calls and gets an authentication error.

How to rotate the Publishable API key (pk_live_ / pk_test_)

1. Open the API keys page in the Dashboard Stripe docs
2. Click the overflow menu (⋯) for the publishable key and select Rotate key. The replacement is always named "Publishable key" Stripe docs
3. Copy the new pk_ value into your client-side code or app and redeploy Stripe docs

Can the old and new key work at the same time? Stripe's docs don't say. The keys page describes the 7-day overlap for keys rotated in the Dashboard without singling out publishable keys. The overlap for publishable keys was not confirmed, and the page says you cannot expire a publishable key.

Revoking the old one: Rotation is the only way the docs describe to replace it; Stripe states a publishable key cannot be expired.

Source: docs.stripe.com/keys, checked 2026-11-09

Does the Publishable API key (pk_live_ / pk_test_) expire?

No. The Publishable API key (pk_live_ / pk_test_) doesn't expire on its own: it works until you revoke it.

What breaks when the Publishable API key (pk_live_ / pk_test_) expires

Publishable keys do not expire. If you rotate one and the old value stops working, Stripe.js, Elements and mobile SDK calls that still use it would fail; the docs do not give the exact error.

How to rotate the Webhook endpoint signing secret (whsec_)

1. In the Dashboard, open the Webhooks tab in Workbench and click the endpoint whose secret you want to roll Stripe docs
2. Open the overflow menu (⋯) and click Roll secret Stripe docs
3. Choose to expire the current secret immediately, or delay its expiration for up to 24 hours so you can update the verification code on your server Stripe docs
4. Reveal the new secret on the endpoint page (Reveal secret) and put it in your webhook receiver's configuration Stripe docs

Can the old and new key work at the same time? Yes. If you delay expiry (up to 24 hours), multiple secrets are active for the endpoint and Stripe generates one signature per secret until expiration, so a receiver using either secret can verify events. Choosing immediate expiry gives no overlap.

Revoking the old one: Choose immediate expiry when rolling, or let the delayed expiry (up to 24 hours) run out.

Source: docs.stripe.com/events/manage-webhook-endpoints, checked 2026-11-09

Does the Webhook endpoint signing secret (whsec_) expire?

It's up to you: you can set an expiry for the Webhook endpoint signing secret (whsec_).

What breaks when the Webhook endpoint signing secret (whsec_) expires

A receiver still using the old secret after it expires would likely fail signature verification. Stripe documents the error "Webhook signature verification failed. Err: No signatures found matching the expected signature for payload." for any case where the body, the Stripe-Signature header or the endpoint secret is wrong, so it does not by itself point to an expired secret. Stripe automatically retries undelivered events for up to three days, and the Event deliveries tab in Workbench shows delivery status.

Each credential

Stripe Dashboard login

• Not documented

Rotate keys when a team member with key access leaves.

Stripe docs

Secret API key (sk_live_ / sk_test_)

• You choose
• Full access only

Unrestricted access to all APIs; Stripe recommends restricted keys instead. Expire it from the overflow menu, or set an expiration when rotating. Choosing Now deletes the old key immediately. Dashboard rotation keeps old and new keys working for up to 7 days. Live keys you created yourself cannot be revealed again after the first view. Docs describe no default expiry; a key can also be scheduled to rotate. Keys unused for payouts or transfers for over 180 days may have that access limited and can be restored in the dashboard.

Stripe docs

Restricted API key (rk_live_ / rk_test_)

• You choose
• Can be scoped

Permissions are set per key. Can be tagged as an agent key, which makes it subject to approval rules for sensitive actions. Rotation uses the same expiration dropdown and up to 7 days of overlap; the replacement keeps the same name. Expiring a key requires creating a new one and updating code. Stripe's agent-key approval rules are a dashboard feature.

Stripe docs

Publishable API key (pk_live_ / pk_test_)

• Doesn't expire
• Full access only

Safe for client code. Stripe states a publishable key cannot be expired. It can be replaced by rotation, which takes effect immediately.

Stripe docs

Webhook endpoint signing secret (whsec_)

• You choose
• Full access only

Per endpoint, not an API key. Roll it in the Workbench Webhooks tab. Choose immediate expiry, or delay the old secret's expiry for up to 24 hours so both secrets sign events during the switch. Stripe recommends rolling periodically and after suspected compromise. Dashboard endpoint secrets and Stripe CLI listen secrets differ.

Stripe docs

Renewals and billing

Balance transactions (GET /v1/balance_transactions) list every charge, fee, refund, payout and adjustment with amount, fee, net and type; filter by created interval. Reports API (Dashboard reports, incl. Balance and Fees) is also available. Verify no customer fields appear in the default response before relying on it.

Where to find it in Stripe

• Open Stripe API keys
• Open Stripe webhooks (Workbench Webhooks tab)
• Stripe go-live checklist

What Stripe's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

• Whether a key's expiry date is returned by the API
• Default expiry for secret and restricted keys when none is chosen (docs describe the choice but not a default)
• Fee schedule and billing model
• Organization API keys (sk_org_) expiry behavior (documented only as org-level keys)
• Exact dashboard label of the Balance resource permission and whether a Read-only choice exists for it
• Whether balance_transactions responses ever include customer fields (fetched doc example shows none)
• Whether the API reports a restricted key permission set (no introspection endpoint found)

Rotating or replacing a Stripe key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Sources

• docs.stripe.com/keys
• docs.stripe.com/events/manage-webhook-endpoints
• docs.stripe.com/keys/restricted-api-keys
• docs.stripe.com/api/balance_transactions/list
• docs.stripe.com/rate-limits
• docs.stripe.com/reporting/statements/api
• docs.stripe.com/connect/identity-verification
• docs.stripe.com/get-started/account/activate

Related providers

Keep track of every Stripe key

StackHangar stores your Stripe keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.