How to create a read-only Stripe API key

Updated 2026-08-04

Stripe has two kinds of API key, and the difference matters enormously if you are about to paste one into a third-party tool.

Secret key (sk_live_…) — full account access. Can charge cards, issue refunds, move money, create more keys. Never give this to anything.
Restricted key (rk_live_…) — you choose exactly which resources it can touch and whether each is read or write. This is the one you want.

Creating one

Open the Stripe Dashboard.
Go to Developers → API keys.
Under Restricted keys, click + Create restricted key.
Give it a name you'll recognise later — FRGMNT read-only works. Naming matters: in a year you want to know what to revoke.
Set permissions (below).
Click Create key, then reveal and copy it. Stripe shows the value once.

Permissions for revenue reporting

Set these to Read. Leave everything else on None.

Permission	Why you need it
Subscriptions	The basis of any MRR calculation
Prices	Resolves what each subscription is worth per interval
Products	Names the thing being sold
Balance transactions	Actual money in, net of Stripe's fee
Charges	Transaction-level detail
Customers	Only if your tool shows customer names — otherwise leave as None

The rule: grant Read where a number depends on it, None everywhere else. If a tool asks for Write on anything to display a dashboard, that is a red flag worth asking about.

A deeper walkthrough of each permission is in Stripe key permissions for reporting.

Test it first

Create a test-mode restricted key (rk_test_…) and connect that first if you want to verify a tool behaves before pointing it at live data. Test mode has no real money in it, so the downside is zero.

What this key still reveals

Being precise, because "read-only" is not the same as "harmless". A reporting key can read:

your total revenue, MRR and growth rate
how many customers you have and what they pay
customer email addresses, if you grant Customers read

It cannot move money, cannot refund, cannot cancel, cannot create new keys, and cannot see full card numbers. So the realistic worst case from a leaked read-only key is disclosure, not loss.

Whether that is acceptable depends on where the key ends up living — which is the real question, covered in is it safe to give an app your Stripe API key?.

Revoking

Any restricted key can be rolled or deleted instantly from the same API keys screen, with no effect on your account or your customers. If you are ever unsure, revoke it — regenerating takes a minute.

Step-by-step: how to revoke a leaked Stripe key.

Using it with FRGMNT

Paste the rk_live_… key into the FRGMNT Vault. It is stored in your device Keychain and used to call api.stripe.com directly from your phone — it is not sent to a FRGMNT server, because there isn't one. See the Stripe integration.

Frequently asked

What does a Stripe restricted key look like?

It starts with rk_live_ for live mode or rk_test_ for test mode. A secret key starts with sk_live_ and should never be given to a third-party tool.

Can a read-only Stripe key issue refunds?

No. If every permission is set to Read or None, the key cannot create, modify or delete anything — including refunds, subscriptions and payouts.

Can a restricted key see my customers' card numbers?

No. Stripe never exposes full card numbers or bank account details through the API regardless of key permissions.