SniffPupLeaked an API key? › Stripe
Leaked Stripe secret key: what to do in the next 10 minutes
Last updated: October 24, 2026. Steps checked against Stripe's own docs on October 24, 2026.
Short answer: Rotate the leaked key on the Dashboard's API keys page and set its expiration to Now. Publishable keys (pk_) are meant to be public; secret (sk_) and restricted (rk_) keys are not.
Which Stripe keys are secret?
- Secret: Secret keys: sk_live_ (live) and sk_test_ (sandbox)
- Secret: Restricted keys: rk_live_ and rk_test_
- Secret: Webhook signing secrets (separate from API keys, set per endpoint)
- Meant to be public: Publishable keys (pk_live_, pk_test_) are made for Stripe.js and mobile SDKs and are safe to expose.
The next 10 minutes
Times are a rough guide. Do the first step before anything else.
1. Rotate the key with expiration Now (Minutes 0-2)
- On the Dashboard's API keys page, open the ⋯ menu for the leaked key, choose Rotate key, and pick Now under Expiration. Stripe: choosing Now deletes the old key; rotating revokes it and gives you a replacement that works immediately.
- Stripe offers a grace period of up to 7 days for planned rotations. For a key that has leaked, the old key keeps working during that window, so the shorter the better.
2. Save the new key on the server and redeploy (Minutes 2-5)
- Copy the new key value right away (Stripe won't show a key you created again), save it in your host's secret store or a server-only environment variable, and redeploy.
- A sandbox key (sk_test_) can't move real money, but rotate it too and keep it out of public code.
3. Check what the key did (Minutes 5-8)
- From the key's ⋯ menu choose View request logs (opens Workbench) and look for requests you don't recognize.
- Check recent payments, refunds, payouts and customers for anything unexpected.
4. Webhook secret, and limit the next leak (Minutes 8-10)
- If a webhook signing secret (whsec_) leaked, open that endpoint in the Webhooks tab in Workbench, roll its signing secret from the ⋯ menu and update your server. Stripe recommends rolling it whenever you suspect it was compromised.
- Stripe recommends restricted keys with only the permissions you need, and access policies (allowed IPs or networks) on live keys so Stripe blocks and notifies you about requests from elsewhere.
Good to know
- Stripe recommends restricted keys (rk_) over secret keys for new uses, because you can limit what they can do.
After the first 10 minutes
Move the code that needs the key to the server (an API route, serverless function or Supabase Edge Function), keep the key in a server-only environment variable, redeploy, and re-check your live site. The general plan, with a prompt you can paste into Lovable, Bolt, Cursor or Claude Code, is in I leaked an API key in my vibe-coded app. What do I do now?
What SniffPup checks, and what it doesn't
A free SniffPup scan reads only what your live site serves to the public: secret key patterns in HTML and same-origin JavaScript (masked in the report) and public files such as /.env and /.git/config. It never uses a key it finds. It can't see your repo, your server or Stripe's logs, so the steps above are always on you. A clean report is not a guarantee of security.
Sources
- Stripe Docs: API keys (rotate, expire, request logs, access policies)
- Stripe Docs: Best practices for managing secret API keys
- Stripe Docs: Webhooks (Roll endpoint signing secrets)
Stripe can change its dashboard and steps at any time. If something here doesn't match what you see, follow Stripe's docs and tell us.