Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Giving an AI agent your Stripe key? Use a restricted key, not your secret key

Ship ItChecked against the official source

Source checked 2 Nov 2026 · Published 2 Nov 2026 · Last reviewed 2 Nov 2026 · By Ctrl+Z Therapy (how we test)

The short answer

Stripe's docs: unlike a secret key that can do anything in your Stripe account, a restricted API key (RAK) can do only what you give it permission to do. A RAK starts with rk_live_ or rk_test_, and Stripe recommends always using RAKs instead of unrestricted secret keys, especially when giving a key to an AI agent.

What to do

  1. In the Stripe Dashboard, open the API keys tab and click Create restricted key.
  2. Name the key, then choose None, Read or Write only for the resources the agent needs. The default value for all permissions is None.
  3. Complete the two-factor verification and save the key value: you can't retrieve it later.

Good to know

  • If a bad actor obtains a RAK, they're limited to that key's permissions. Still treat RAKs with the same caution as secret keys.
  • On Vercel: since October 23, 2026, Vercel Connect can create a separate restricted Stripe API key for each agent or task, limited to the permissions you pick, so there is no secret key to paste.

Source

Checked on 2 Nov 2026. Prices, limits and settings change, so check the source before you rely on them.

Related