Guides · Updated October 17, 2026
Which permissions does a Stripe restricted key need for read-only auditing?
Billing audits, reconciliation tools and AI agents all ask for Stripe access. The safe answer is a restricted key with Read on just the resources the job needs. Here's what each permission is for when the goal is a read-only audit of subscriptions, payments and webhooks, and what you can leave at None.
Restricted keys in one paragraph
A restricted API key (rk_live_ or rk_test_) can only do what you allow. For each resource you choose None, Read or Write, and Write implies Read. Stripe recommends restricted keys instead of secret keys wherever possible, especially for third parties and AI agents, because a leaked restricted key is limited to its permissions (Stripe: Restricted API keys). Stripe maps GET requests to Read and POST/DELETE requests to Write, so an audit that only reads needs no Write permission at all.
Permissions for a read-only billing audit
| Resource (Read) | What it lets an audit see | Needed for |
|---|---|---|
| Customers | Customer IDs, emails, metadata (for example your user ID) | Matching Stripe customers to users in your app |
| Subscriptions | Status (active, trialing, past_due, unpaid, canceled), prices, item quantities | Who should have access; seat counts |
| Charges | Payments, amounts, refund status | Double charges, refunds, one-time payments |
| Events | Recent events, including ones not delivered to your webhooks (List events) | Failed webhook deliveries |
| Webhook Endpoints | Endpoint URLs, status, subscribed events (List webhook endpoints) | Disabled endpoints, missing event subscriptions |
| Checkout Sessions (optional) | Completed sessions, mode (payment or subscription), line items | One-time purchases and lifetime deals |
| Invoices (optional) | Invoices and invoice payments | Linking charges to billing periods; one-time charges with no invoice |
| Entitlements (optional) | Active entitlements per customer (Entitlements) | Access granted through Stripe features |
Everything else can stay at None: payouts, balance, transfers, payment methods, products you don't sell, Connect, Issuing and so on. If a tool asks for more than this for a read-only audit, ask why.
Live vs test keys
Keys exist per mode: rk_test_ keys only see test or sandbox data, and rk_live_ keys see real data (Stripe: API keys). Try a new tool with a test key first, then create a separate live key with the same permissions.
Good hygiene
- Create one key per tool or integration, named after it, so you can see its usage and revoke it alone.
- Check the key's request logs in the Dashboard if something fails; permission errors show up there.
- Roll or delete keys you no longer use, and never paste secret keys into chats, tickets or tools (Stripe: API key best practices).
Check a key in seconds
The free Stripe restricted key checker tests each of the resources above with a read-only request and tells you which permissions are missing. It refuses secret keys and stores nothing. It can't detect Write access, because it never attempts a write.
FAQ
Does Read on Customers expose card numbers?
No. Stripe never returns full card numbers through the API. Read on Customers does expose customer details such as email, name and metadata, so only grant it to tools you trust with that data.
Do I need Write on anything for an audit?
No. An audit only lists and reads objects, which are GET requests. Stripe maps GET requests to Read and POST/DELETE to Write, so a read-only audit key needs no Write permissions at all.
Should I use a live or a test key?
Use a test (sandbox) key to try a tool safely. An audit of real customers needs a live key, because test keys only see test data.
How do I know which permission is missing?
If a restricted key lacks a permission, Stripe rejects the request with an error, and the message usually names the missing permission. You can also see the key's failed requests in its request logs in the Dashboard, or paste the key into PaidCheck's restricted key checker.
Check your own account
PaidCheck's free leak report runs these comparisons with a read-only Stripe restricted key. Upload a CSV of your users or connect nothing for Stripe-only checks. Nothing is stored.
Run a free leak report →