How to create a restricted read-only Stripe key

To create a restricted read-only Stripe key, open Developers, then API keys, then Create restricted key, and give read access to Customers, Subscriptions, Invoices, and Charges and Refunds. Leave everything else as None. This is the exact setup I ask for before a Revenue Leak Report, and it takes a couple of minutes.

What is a restricted key?

A restricted key is a Stripe API key where you choose, resource by resource, what it can do. You can give a resource no access, read access or write access. A key with read access only can look at data. It cannot create a charge, refund a payment, cancel a subscription or edit a customer.

That is the whole reason I ask for one. My analysis only needs to look at history, so it should not hold a key that can do anything else.

Which permissions does the report need?

Four, all at Read:

Everything else stays at None. If one of these is missing, the run fails with an error naming the path. It does not quietly return zeros, which would be a worse outcome because you might believe them.

How do I create it, step by step?

1. Sign in to your Stripe dashboard.
2. Go to Developers, then API keys.
3. Choose Create restricted key.
4. Name it something you will recognise later, such as the date and "leak report".
5. Set Customers, Subscriptions, Invoices, and Charges and Refunds to Read. Leave every other resource at None.
6. Create the key and copy it, ready to paste into the secret link.

Use a live-mode key, which starts with rk_live_. A test-mode key is only useful if you have no live data yet, and then the report would describe the test data, not your business.

How should I send it to me?

Through a one-time secret link, never in plain email or a chat history that stays searchable. I will send the link on request. The 48-hour clock starts when I have the key, not when you pay or fill in the form.

Do not send a secret key, the kind that starts with sk_. A secret key can do far more than read. My command line tool warns if it is given one, and it refuses publishable keys that start with pk_. If you are not sure which one you have, check the prefix: a restricted key starts with rk_. If yours starts with anything else, stop and ask me.

What else do I need to tell you?

Three short answers make the caveats checkable:

• Which currency you bill in. Non-USD amounts are excluded unless we agree a conversion rate.
• Whether you already send failed-payment emails or have a cancel flow. I cannot see either in Stripe.
• The name you want printed on the report.

What happens to the key afterwards?

When I deliver the report I ask you to revoke the key, and I confirm that you did. In your dashboard, open the key and roll or delete it. Access ends immediately. On my side I delete the local files and the key from my shell environment, and I keep the PDF as the only artifact.

The raw Stripe data is not saved by the tool. Under the privacy policy, any Stripe data used for a report is deleted within 30 days of delivering the report, unless you start a pilot. You can read the full policy on the privacy page.

Can a read-only key change my account?

No. The client only sends read requests, and the key itself has no write permission, so there are two layers. If you want to check the first claim, the permission list above is the second: you can see it in your dashboard at any time.

I go further into what a key like this can and cannot do in is it safe to give someone a read-only Stripe key.

What if Stripe asks for a purpose or a label?

While I was checking this, I found third-party sources saying Stripe will change how some keys are accepted from December 2026, but only for its MCP server. My tool calls the ordinary REST API instead. I did not find Stripe's own announcement, so I treat that as unconfirmed and I re-check Stripe's changelog before the end of November. Create the key the ordinary way, as a restricted read-only key. If the dashboard asks for a purpose and offers an agent-access option, a key tagged that way should have the same permissions, according to those same sources. Tell me what you see and I will confirm it. If anything is unclear, ask me before you create the key.

How long does the whole thing take?

On your side, a couple of minutes to create the key and a minute to send it. On mine, about an hour: I run the tool, which takes one to five minutes, then I spend roughly twenty minutes checking the numbers against what you know about your business, fifteen editing the wording, and ten looking at the PDF page by page before I send it. I mention this so you know the 48 hours is mostly checking, not waiting.

The one check I care about most is active recurring revenue. If the figure in the report is not within about 10% of the one in your dashboard, I stop and ask you why before anything goes out. Small accounts get a warning in the cover email: with fewer than about 30 events in a bucket, treat the numbers as direction, not a result.

What do I get for it?

The key is the only input. In return, the Revenue Leak Report is $490 and arrives within 48 hours of my having it. You can read what it covers in what a revenue leak report is, or open the sample report, which uses synthetic data.