What can a restricted Stripe key actually do?

Exactly what you grant it and nothing else. Stripe lets you switch each resource to None, Read or Write individually, so a key scoped to Subscriptions: Read and Customers: Read can list those two things and do nothing at all with charges, payouts, refunds, balances or account settings. It cannot move money in any direction.

How is that different from a secret key?

A secret key — one starting with sk_ — is your whole account. It can charge cards, issue refunds, move payouts and change settings. There is no reason for a tool that measures revenue to hold one, and being asked for it is a reason to stop.

Can I take the access away later?

Yes, immediately, from your own Stripe dashboard, without telling anyone. Roll or delete the key and the tool stops working the moment you do. That asymmetry is the point of a restricted key: the permission is narrow and revoking it is yours alone.

Can they see my customers' card details?

No. Card numbers are never exposed by the Stripe API to any key — Stripe holds them and returns only a token and the last four digits. There is no scope that grants them.

What should I check before connecting anything to my billing?

Four things. That it asks for a restricted key rather than a secret one. That it names the exact permissions it needs instead of asking for everything. That it says how the key is stored. And that revoking is one click on your side rather than an email to support.

How does Thonest store the key?

Encrypted at rest with AES-256-GCM, and used only to read subscriptions. It is never shown back to you, never sent to a browser, and never included in error reports or alerts. Disconnecting deletes it.

For founders

Is it safe to connect Stripe to a third-party tool?

It depends entirely on which kind of key you hand over, and most people are never told there is more than one. Here is what each can do, and what to check before connecting your billing to anything — including us.

Two keys, and only one is safe to give away

A secret key starts with sk_ and is your account. It can charge cards, refund them, move payouts, change settings. Handing one over is handing over the business.

A restricted key starts with rk_, and you decide what it may touch. Stripe lets you set every resource to None, Read or Write independently, so a key with Subscriptions and Customers on Read can list those two things and is powerless everywhere else. It cannot move a penny in any direction, because you never gave it the ability to.

Making one takes about a minute

In Stripe, go to Developers → API keys and choose Create restricted key.
Name it after whatever you are connecting, so you know what you are revoking later.
Set Subscriptions: Read and Customers: Read. Leave everything else on None.
Create it, copy it once, and paste it where it is going. It starts with rk_live_.

Deleting it later is the same page, one click, and it takes effect immediately. You do not need anyone’s permission or cooperation to cut a tool off.

What to check before connecting anything

This applies to any product asking for your billing, not just this one:

Does it ask for a restricted key? If it wants sk_, stop. Whatever it does is not worth account-wide write access.
Does it name the permissions? A product that knows what it needs will tell you the exact resources. One that says “connect your Stripe” and nothing more has not thought about it.
Does it say how the key is stored? Encrypted at rest is the answer you want. Silence is not.
Can you revoke without asking them? If cutting access means emailing support, the access was never really yours to control.

What Thonest does with it

We ask for a restricted key with Subscriptions and Customers on Read, and we refuse a secret key outright — paste one and the form tells you why rather than accepting it. The key is encrypted at rest with AES-256-GCM, used only to list subscriptions, and never shown back to you, sent to a browser, or included in an error report. Disconnecting deletes it.

Nothing is published until you publish it, and you choose which moments appear. What “verified” means · how the numbers are counted

Questions founders ask

What can a restricted Stripe key actually do?: Exactly what you grant it and nothing else. Stripe lets you switch each resource to None, Read or Write individually, so a key scoped to Subscriptions: Read and Customers: Read can list those two things and do nothing at all with charges, payouts, refunds, balances or account settings. It cannot move money in any direction.
How is that different from a secret key?: A secret key — one starting with sk_ — is your whole account. It can charge cards, issue refunds, move payouts and change settings. There is no reason for a tool that measures revenue to hold one, and being asked for it is a reason to stop.
Can I take the access away later?: Yes, immediately, from your own Stripe dashboard, without telling anyone. Roll or delete the key and the tool stops working the moment you do. That asymmetry is the point of a restricted key: the permission is narrow and revoking it is yours alone.
Can they see my customers' card details?: No. Card numbers are never exposed by the Stripe API to any key — Stripe holds them and returns only a token and the last four digits. There is no scope that grants them.
What should I check before connecting anything to my billing?: Four things. That it asks for a restricted key rather than a secret one. That it names the exact permissions it needs instead of asking for everything. That it says how the key is stored. And that revoking is one click on your side rather than an email to support.
How does Thonest store the key?: Encrypted at rest with AES-256-GCM, and used only to read subscriptions. It is never shown back to you, never sent to a browser, and never included in error reports or alerts. Disconnecting deletes it.

Read-only, and revocable in one click.

Connect your billing and your verified history appears in about a minute. Nothing is public until you say so.

Build my timeline See a finished one