Free tool
Stripe restricted key permission checker
Paste a Stripe restricted key to see which resources it can read, whether it's a live or test key, and which Read permissions to add for a read-only billing audit.
What it checks
For each resource below, the checker makes one read-only list request (limit 1) with your key. A permission error means "no access". These are the same resources PaidCheck's leak report reads, from the same code.
| Customers | Required | match a subscription to the customer's email, ID and metadata |
| Subscriptions (Billing) | Required | know who is active, trialing, past_due, unpaid or canceled, and seat quantities |
| Charges | Required | detect duplicate charges, refunds and one-time payments |
| Events | Required | find events whose webhook delivery failed (pending_webhooks > 0) |
| Webhook Endpoints | Required | detect disabled endpoints and endpoints missing key events |
| Checkout Sessions | Optional | one-time purchases (mode=payment) and telling separate checkouts apart |
| Invoices | Optional | link charges to subscription periods (fewer double-charge false positives) and invoice emails |
| Entitlements | Optional | count Stripe active entitlements as paid access |
Refunds are read through Charges, seat counts through Subscriptions, and webhook health through Events and Webhook Endpoints.
What a Stripe restricted key is
A restricted API key starts with rk_live_ or rk_test_. Unlike a secret key, which can do anything in your account, a restricted key can only do what you allow: for each resource you choose None, Read or Write, and Write implies Read (Stripe: Restricted API keys). If a restricted key with only Read permissions leaks, it can't create charges, issue refunds or change customers.
How to create one
- In the Stripe Dashboard, open Developers → API keys and click Create restricted key. Use live mode for real data, or a sandbox to try it out.
- Name it (for example "PaidCheck read-only").
- Set Read on Customers, Subscriptions, Charges, Events and Webhook Endpoints. Optionally also Read on Checkout Sessions, Invoices and Entitlements. Leave everything else at None.
- Create the key, complete Stripe's verification, and copy the value. You can't view it again later (steps in Stripe's docs).
Keep keys out of code and chats, and roll or delete keys you no longer use (Stripe: API key best practices). For the reasoning behind each permission, read which permissions a Stripe restricted key needs for read-only auditing.
FAQ
Is it safe to paste a restricted key here?
The checker refuses secret keys and only accepts restricted keys. It uses the key for read-only list requests that fetch at most one object per resource, in a single request, and then discards it. The key isn't stored, logged, emailed or sent to analytics, and the response never includes it. Still, treat any key like a password: only paste keys whose permissions you're comfortable sharing, and delete or roll a key you no longer need.
Why are secret keys (sk_) rejected?
A secret key can do anything in your Stripe account, including creating charges and issuing refunds. A restricted key can only do what you allow per resource (None, Read or Write), so if it leaks, the damage is limited to those permissions. Stripe recommends restricted keys wherever possible.
Can the checker tell whether my key has Write access?
No. Finding out would mean attempting a write, and this tool never makes write requests. Open the key in the Stripe Dashboard and check that everything you don't need is set to None. For auditing, Read is enough.
What's the difference between rk_live_ and rk_test_ keys?
rk_live_ keys read your real (live-mode) data; rk_test_ keys only see test or sandbox data. A test key is fine for trying things out, but a billing audit of real customers needs a live key.
Why does Entitlements sometimes say "couldn't check"?
Stripe lists active entitlements per customer, so the probe needs a customer readable with the same key. If the account has no customers or the key can't read customers, that permission can't be tested.
Got a working key? Find your billing leaks
The free leak report uses the same read-only key to find customers who paid but have no access, cancelled users still inside, double charges and failed webhooks.
Run a free leak report →