How Do I Get My Stripe API Key?

Your Stripe API keys are on the API keys page of your Stripe Dashboard. Stripe gives each account three kinds: a publishable key (starting pk_), restricted keys (rk_) and a secret key (sk_), with separate sets for testing in a sandbox and for live payments. Stripe recommends restricted keys over secret keys "for most use cases", and says only the publishable key is safe to expose. The steps below are quoted from Stripe's own documentation.

Billed publishes this page. Stripe's wording is quoted from its API keys and best practices for managing secret API keys docs, opened on October 30, 2026. Stripe updates its Dashboard, so check those pages if a label has changed.

Where to Find Your Keys

Stripe's API keys doc says: "Use the API keys page in the Dashboard to create, reveal, expire and rotate keys for the account or sandbox you're viewing." You can open that page directly at dashboard.stripe.com/apikeys after you log in.

The Three Kinds of Key

From Stripe's API keys doc:

• Publishable key (pk_): "It can identify your account and create tokens or PaymentMethods from payment details, but it can't perform sensitive operations such as creating charges or reading account data."
• Restricted key (rk_): an "API key with permissions you control."
• Secret key (sk_): an "API key that has unrestricted permissions on all Stripe APIs." Stripe adds: "Because you can't limit their permissions, we don't recommend using secret keys for new use cases".

On which to use, Stripe says: "Use restricted API keys (RAKs) for most use cases."

Sandbox Keys and Live Keys

Stripe keeps testing and real payments apart. The API keys doc says: "Each mode has its own set of API keys, and objects in one mode aren't accessible to the other."

• Sandbox (testing): "Sandbox keys start with pk_test_ for publishable keys, rk_test_ for restricted keys, and sk_test_ for secret keys."
• Live (real payments): "Switch to your live mode keys, which start with pk_live_, rk_live_, and sk_live_."

Stripe adds: "In a sandbox, card networks and payment providers don't process payments."

Revealing or Creating a Secret Key

Stripe shows a live secret key only once in some cases, so copy it carefully. From the API keys doc:

• Creating one: "On the API keys page, click Create secret key." Then "Click the key value to copy it." Stripe notes: "When you create a secret key in live mode, Stripe displays it one time before you save it. Copy the key before you save it because you can't reveal it later."
• Revealing one Stripe created for you: "On the API keys page in live mode, in the Standard keys list, click Reveal live key for the key you want to reveal." Stripe adds: "You can reveal only live-mode secret keys that we created for you."

Rotating a Key

The API keys doc says: "Rotating an API key revokes it and generates a replacement key that's ready to use immediately." On the API keys page, open the menu for the key, then "Select Rotate key." Choose when the old key expires, then "Click Rotate API key."

Stripe lists reasons to rotate, including "If a team member with access to the key leaves your organisation or changes roles." and "If your policy requires rotating keys at certain intervals." After rotating, update the key anywhere it's used.

What Stripe Says About Keeping Keys Safe

These points are Stripe's own, from its docs:

• "Only publishable keys are safe to expose outside your application's back end."
• "Bad actors continuously scan public repositories for Stripe API keys."
• "Stripe never asks you for your secret API key."
• "If a restricted or secret API key is exposed or compromised, rotate it immediately even if you aren't sure anyone saw it."

For anything more, follow Stripe's best practices doc and Stripe support.

Worked Example: A Rotation With an Overlap (sample figures)

The business and dates here are a sample, invented for this example. The 90-day interval is the sample business's own policy, not a Stripe rule; Stripe leaves the interval to you.

A sample design studio rotates its live restricted key on Thursday, October 1, 2026, and sets the old key to expire 7 days later:

• Rotated: Thursday, October 1, 2026
• Old key expires: October 1 + 7 days = Thursday, October 8, 2026. Until then, both keys work, so the studio can update each tool that uses the key.
• Next rotation under its policy: October 1 + 90 days = Wednesday, December 30, 2026

Connecting Stripe to Billed

Billed's help center article How Do I Accept Online Payments With Stripe? says: "Billed allows its users to receive online payments through Stripe." Billed's Stripe integration page says Billed connects to Stripe through Stripe Connect. For help connecting your Stripe account to Billed, contact Billed support.

When This Guide Isn't for You

If you're building your own Stripe integration, follow Stripe's developer documentation in full; this page covers finding and handling keys. For PayPal, see how do I get my PayPal API signature.

Related Guides

• Stripe vs PayPal for Small Business
• How to Accept Online Payments for Your Small Business
• How Do I Get My PayPal API Signature?
• What Are Integrated Payments?

Frequently Asked Questions

Where do I find my Stripe API key?

On the API keys page of your Stripe Dashboard. Stripe's docs describe it as the place to manage keys: making them, viewing them, setting them to expire and replacing them, for live mode and for each sandbox.

What is the difference between Stripe's publishable key and secret key?

The publishable key identifies your account and can create tokens from payment details, but it can't create charges or read account data. The secret key has unrestricted access to Stripe's APIs, and Stripe recommends restricted keys instead "for most use cases".

Why can't I see my live secret key?

Stripe shows a live secret key one time when you create it. It can reveal only live secret keys that Stripe created for you. If you've lost a key, Stripe's docs say to replace it, by rotating it or by removing it and making a new key.

What should I do if my secret key is exposed?

Stripe says to rotate an exposed or compromised restricted or secret key right away, whether or not you know someone saw it. Then put the new key wherever the old one was used.