How to create a restricted Stripe API key (read-only)

A restricted Stripe API key is a key you scope yourself: you pick a permission level per resource, and everything else is off. For anything that only reads your revenue — dashboards, reporting scripts, third-party tools — it's the right key to hand out, because your full secret key (sk_live_…) can move money and a restricted read-only key can't do anything but look.

Create the key

1. Go to dashboard.stripe.com/apikeys
2. Check the Test / Live mode toggle first — the key is bound to whichever mode you're in when you create it
3. Click Create restricted key
4. Name it after the thing that will use it (e.g. "revenue dashboard") so you know what to revoke later
5. Set Read on Subscriptions and Prices (under Products) — leave every other resource on None
6. Click Create key and copy the value — it starts with rk_live_ or rk_test_

That's the complete permission set for subscription metrics. MRR is derivable from active subscriptions and their prices; charges, customers, payouts, and balance can all stay at None.

Test it with curl

Stripe authenticates with the key as the basic-auth username (note the trailing colon):

curl -s "https://api.stripe.com/v1/subscriptions?limit=1" -u rk_live_XXXX:

A correct key returns a subscription list. If you ask for something outside the key's permissions — say /v1/charges — Stripe returns a permission_error telling you which permission the key lacks. That error is the whole point: the blast radius of a leak is "someone saw my subscription count", not "someone issued refunds".

Revocation is instant: delete the key in the dashboard and create a new one. Because you named it after its consumer, you know exactly what broke.

Why not just use the secret key?

The sk_ key is root: it can create charges, refund payments, and delete customers. Any tool that says "just paste your secret key" is asking you to trust them with write access to your revenue. Don't — create a restricted key instead. It takes a minute and it's what restricted keys exist for.

Put your MRR on a public page

Public revenue is the strongest build-in-public signal there is — and the hardest one to fake. The infra.page Stripe widget takes exactly the key you just created and shows MRR plus active subscriber count, live. If the absolute number is more than you want public, the disclosure setting can show growth only — the trend builds trust, the number stays yours.

Related setup guides: get your beehiiv API key and create a Sentry auth token.