Stripe secret key exposed: rotate it safely

"If Stripe detects an exposed secret or restricted API key, we notify you and
request that you rotate the key. In some cases, Stripe deactivates the key
proactively."

sk_live_...   secret key: rotate now
rk_live_...   restricted key: rotate now
pk_live_...   publishable key: safe to expose, no action needed

Why it happens

Stripe secret keys work like a username and password for your account. Stripe warns that someone holding one can make charges, read customer data or disrupt your integration, and that bad actors continuously scan public repositories for them.

Stripe's advice is to rotate an exposed key immediately even if you aren't sure anyone saw it, and to treat any exposure as a potential compromise.

Fix it by hand

1. Rotate the key. In the Stripe Dashboard open Developers, then API keys. On the leaked key, open the overflow menu and choose Rotate key. Set the old key's expiration to Now (otherwise the old key can keep working for up to 7 days), then confirm.
2. Copy the new key right away. Stripe shows it once. Put it in your host's secret settings, not in code.
3. Update every server and CI job that uses STRIPE_SECRET_KEY, and redeploy.
4. Check what happened. On the key, choose View request logs and look for calls you don't recognise. Review payouts, external bank accounts and connected accounts for anything new.
5. Roll the webhook secret too if your whsec_ signing secret was in the same file: open the webhook endpoint and roll its secret.
6. Follow Stripe's compromised-key guide if you see unauthorized activity, and contact Stripe support.

Stop it happening again

• Use restricted keys with only the permissions each service needs, instead of the full secret key.
• Restrict keys to your servers' IP addresses where you have fixed IPs.
• Only pk_ keys belong in frontend code. Every sk_ or rk_ call goes through your server.
• Use a separate key per service, so a leak needs only one rotation.