Read-only API keys for revenue tools

Updated 2026-08-04

Connecting any tool to your revenue means handing over a credential. The whole game is making that credential as narrow as possible.

Support for this varies enormously by platform, and it's worth knowing where you have real control and where you don't.

Platform by platform

Platform	Granular read-only?	Credential
Stripe	✅ Excellent	Restricted key, per-resource read/write/none
PayPal	✅ Good	REST app with scoped permissions
App Store Connect	🟡 Role-based	API key with a role such as Sales and Reports
Lemon Squeezy	❌ Account-scoped	API key, no granular control
Gumroad	❌ Account-scoped	Access token

Stripe — the gold standard

Stripe's restricted keys let you set every resource to Read, Write or None individually. A properly scoped reporting key cannot refund, charge, cancel or create further keys.

Detailed permission list: Stripe key permissions for reporting.

PayPal — scoped REST apps

A REST app gets a client ID and secret, and you choose which features it can use. Grant reporting, deny payouts and refunds.

App Store Connect — roles, not resources

App Store Connect keys carry a role. Use Sales and Reports, never Admin. Note the private key downloads exactly once.

Lemon Squeezy and Gumroad — no granular control

Lemon Squeezy and Gumroad both issue account-scoped tokens. You cannot restrict them to read-only.

This is a genuine limitation and worth weighing: a leaked token here is more consequential than a leaked Stripe restricted key. Mitigate by rotating periodically and revoking immediately if a device is lost.

The three questions for any tool

Does it accept the narrowest credential the platform offers? A tool demanding a Stripe secret key when restricted keys exist is badly designed at best.
Where is the credential stored? A vendor database is a much bigger target than your own device.
How fast can you revoke? On every platform above, seconds — from the same screen you created it on.

The residual risk

Even a perfectly scoped read-only key reveals your revenue, customer count and growth rate. That's inherent: a tool that shows you your numbers must be able to read your numbers.

What you're controlling for is the difference between disclosure and loss. A read-only key caps the downside at the former.

More on the reasoning: is it safe to give an app your Stripe API key? and revenue tracking without handing over your data.

Frequently asked

Which revenue platforms support truly read-only keys?

Stripe has the best support with granular restricted keys. PayPal lets you scope a REST app. App Store Connect has role-based keys. Lemon Squeezy and Gumroad issue account-scoped tokens without granular read-only control.

What is the minimum permission a revenue dashboard needs?

Read access to subscriptions, prices and balance transactions or their equivalents. Anything asking for write access to display a dashboard is over-scoped.