How to revoke a leaked Stripe key

Updated 2026-08-04

If you think a key is exposed, revoke it. It takes about thirty seconds, breaks nothing for your customers, and regenerating is trivial. There is no reason to hesitate.

Revoking

Open Developers → API keys.
Find the key. This is where naming keys sensibly pays off.
Click the ⋯ menu.
Choose Roll key or Delete key.

Roll generates a replacement immediately and lets you set a short expiry on the old one — use this if something in production depends on it, so you have a window to swap it over.

Delete kills it instantly. Use this if nothing legitimate is using it, or if you'd rather break a service than leave a window open.

What revoking does not do

It doesn't touch subscriptions, payments, customers or payouts. It doesn't notify anyone. It doesn't affect your account standing. It simply stops that credential from working.

Working out what was exposed

Developers → Logs shows every API request made with each key: timestamp, endpoint, IP address, response.

Filter by the affected key and look for:

Requests from IPs you don't recognise
Endpoints your own integration never calls
Activity outside your normal usage pattern
Any write operations — the serious case

If it was a restricted read-only key

The realistic exposure is disclosure: someone may have read your revenue, subscription and customer counts, and email addresses if you granted Customers read.

They could not refund, charge, cancel or move money. Unpleasant, not catastrophic. More on the threat model: is it safe to give an app your Stripe API key?

If it was a secret key

Different situation. A sk_live_ key can move money. In addition to revoking immediately:

Check Payments for charges you don't recognise
Check Refunds for refunds you didn't issue
Check Payouts for changed bank details
Check for new API keys created by the leaked key
Contact Stripe support

Preventing the next one

Use restricted keys, never secret keys, for third-party tools
Grant the minimum permissions
Name every key after where it's used
Delete keys for tools you've stopped using — dormant credentials are the ones that leak
Prefer tools that store keys on your device rather than on their servers

A note on device-stored keys

If you use a tool that keeps keys on your phone rather than a server — as FRGMNT does — losing the device is the exposure event, not a vendor breach. Remote-wipe the device, and revoke the keys anyway. Belt and braces costs thirty seconds.

Frequently asked

Does revoking a Stripe API key affect my customers?

No. Revoking a key stops applications using that key from calling the API. Existing subscriptions, payments and customer data are untouched.

How do I know if a leaked key was used?

Stripe's Developers to Logs section shows every API request with its key, timestamp, IP and endpoint. Filter by the key to see exactly what was called.

Should I roll or delete the key?

Rolling generates a replacement and gives you a short expiry window on the old one, which is safer if the key is in production. Delete outright if nothing legitimate is using it.