If your website takes payments through Stripe, one setting is worth ten minutes this week: the permissions on the API key your server uses. Many sites run on the default secret key, which can do almost anything in the Stripe account. A restricted key can do only what you allow, so a leak does less damage.
What happened this week
On 23 October 2026 Vercel announced that Vercel Connect can create a separate restricted Stripe API key for each agent or task. When you create a Stripe connector you can choose Managed API Key as the connection method. Vercel creates the key in your Stripe account with the permissions you pick, stores it, and lets you rotate it from the connector settings without redeploying. Vercel says the old key stays valid for up to 24 hours while you switch.
Vercel's own example is useful for any business: a daily revenue report can be limited to read-only access to charges, and an onboarding step can be limited to writing customers.
Why this matters even if you do not use Vercel
Stripe's documentation treats secret keys like account credentials. If an unauthorized party gets one, Stripe says they can make unauthorized charges, access customer data or disrupt your integration. Its advice has four parts:
- Use restricted API keys with limited permissions instead of unrestricted secret keys.
- Keep keys in a secrets vault, or in environment variables marked sensitive, and never in source code or in apps.
- Rotate keys periodically so you know where each one is used and can replace it fast.
- Audit API request logs for unusual activity.
Stripe also says it will notify you and may deactivate a key if it detects exposure, but it does not guarantee detection, so you cannot rely on that. We saw the same lesson in the Railway incident, where users were told to rotate every stored secret.
A practical checklist
- List every place a Stripe key lives. Hosting variables, CI settings, plugins, no-code tools and contractors' laptops.
- Note what each one needs to do. A reporting tool needs read access. A checkout page needs to create payments. A support tool may only need customers.
- Create a restricted key per job in your Stripe Dashboard with only those permissions.
- Replace one key at a time. Put the new key in your secrets store, deploy, test a real payment flow in test mode first, then revoke the old key.
- Never use live keys where test keys will do. Stripe recommends using sandbox keys when appropriate.
- Limit who can create or read keys, and check that list quarterly.
- Add a scanner or pre-commit check that rejects code containing keys.
- Check API request logs after the change, and again monthly.
- Write down your rotation steps so a leak is a ten-minute job.
If your hosting platform offers managed Stripe keys, Stripe says to mark them as sensitive where supported, never expose environment variables on error pages, and expect to redeploy after a rotation unless the platform does it for you.
For other upkeep tasks that stop small problems becoming big ones, see our website maintenance guide and the mobile app security checklist. Need help auditing the keys behind your checkout? Talk to Susraj Tech.
Frequently asked questions
What is a Stripe restricted API key?
A key with only the permissions you choose, so a leak can only make those calls.
Do I need Vercel to use restricted keys?
No. They are a Stripe feature and work with any hosting setup.
Sources
- Vercel changelog: Vercel Connect adds managed Stripe API keys (23 October 2026)
- Stripe docs: Best practices for managing secret API keys
Last reviewed 23 October 2026. This article is general security information, not a guarantee of protection. Check Stripe's and your platform's documentation for current options.
