Stripe key permissions for reporting

Updated 2026-08-04

Stripe restricted keys let you set every resource independently. Here's what a revenue dashboard actually needs, and why.

The minimum set

Set to Read. Everything else None.

Subscriptions — required

The basis of MRR. Tells you which subscriptions are active, on what plan, at what interval, in what state.

Without this there is no recurring revenue figure at all.

Prices — required

A subscription references a price; the price holds the amount and the billing interval. You need both to normalise annual and weekly plans to a monthly figure. See how to calculate MRR.

Products — recommended

Names the thing being sold. Without it you get amounts without labels — the numbers are right, the display is opaque.

Balance transactions — required for cash figures

This is the one people miss. A charge says what a customer was billed. A balance transaction says what actually landed, after Stripe's fee and after refunds.

If you want today's cash net of fees rather than gross volume, you need this.

Charges — recommended

Transaction-level detail for a live ledger — what happened, when, how much.

Customers — optional

Only if you want names or emails shown. Leave it off unless you need it — it's the permission that exposes personal data, and MRR doesn't require it.

What to leave off

Everything else, but specifically never grant Write on anything for a reporting tool. There is no dashboard feature that requires the ability to create a refund, modify a subscription or issue a payout.

Also leave off:

Payouts — unless you specifically want to see bank transfers
Connect — unless you run a platform with connected accounts
Webhook endpoints — a tool that needs webhooks should ask you to create them, not create them itself
API keys — a key that can mint keys defeats the point of restriction

Quick reference

Permission	Level	Needed for
Subscriptions	Read	MRR
Prices	Read	Interval normalisation
Products	Read	Labels
Balance transactions	Read	Net cash, fees, refunds
Charges	Read	Ledger detail
Customers	Read (optional)	Names and emails
Everything else	None	—

Testing the scope

Create the key, connect it, and confirm the numbers appear. If something is missing, Stripe's API returns a clear permission error naming the resource — add that one and nothing more.

Starting narrow and widening only when something breaks is a better habit than granting broadly and trusting the tool to behave.

Revoking

Instant, from Developers → API keys, with no effect on your account or customers. How to revoke.

Frequently asked

What Stripe permissions are needed to calculate MRR?

Read on Subscriptions, Prices and Products. Subscriptions give you who is active, Prices give you what each is worth per interval, Products name the thing being sold.

Do I need to grant Customers read access?

Only if you want customer names or emails displayed. MRR and cash figures do not require it, so leave it off unless you need it.

Why does a dashboard need balance transactions?

Because charges show what a customer was billed, while balance transactions show what actually landed after Stripe's fee and after refunds. Net cash figures need the latter.