sk_live_…
Exposed Stripe Secret Key? Here's how to detect and rotate it
A live Stripe key (sk_live_…) lets anyone move money and read customer data. Scan free with Trust, then roll the key in your Stripe Dashboard in seconds.
A Stripe secret key beginning with sk_live_ is the master credential for your live Stripe account. It authorizes real charges, refunds, and payouts, and gives full read access to customer and payment data via the API. Stripe shows a live secret key only once.
What an attacker can do with a leaked Stripe Secret Key
- Creates refunds or payouts to drain your Stripe balance and available funds.
- Reads your full customer list — emails, charge history, and partial card metadata.
- Creates new charges or subscriptions, or tampers with existing ones.
- Registers malicious webhooks or alters account settings to intercept future events.
How Stripe Secret Keys get exposed
- Committed to a repo or left in a .env that was pushed publicly.
- Hardcoded in backend code that ended up in a shared or open-source project.
- Accidentally used client-side instead of your publishable key (pk_live_).
- Captured in server logs, error trackers, or a screenshot of your terminal.
Scan your repo and live site for exposed Stripe Secret Keys — free
Trust checks your code, git history, and shipped JavaScript. No signup, results in about a minute.
Run a free scan →How to rotate a leaked Stripe Secret Key
- Go to the Stripe Dashboard → Developers → API keys.
- Find the compromised secret key row and click the ‘…’ menu → Roll key.
- Pick an expiration window for the old key long enough to test the new one (use ‘expire immediately’ only for an active emergency).
- Copy the new key and update your backend environment variables.
- Verify live traffic works by checking request logs for the new key.
- Once confirmed, delete the old key from the same ‘…’ menu.