How to create a restricted API key in Stripe for an agent or MCP
Open Developers, then API keys, click Create restricted key, name it, set each resource to None, Read or Write, and click Create key. Copy the rk_ key once and give it to the agent or MCP server instead of your secret key.
This is for someone connecting a coding agent, the Stripe MCP server or another tool to Stripe who does not want to hand over the full secret key. A restricted key can only touch the resources you allow, so an agent that only needs to read products and prices cannot refund a payment. Start in test mode, grant the least it needs, and widen later.
Before you start
You need a Stripe account with the Administrator role, or a Developer role that can manage API keys.
- Time
- About 3 minutes
- Account
- Not walked yet
| Role | What it can do here |
|---|---|
| Administrator | Can create, roll and delete restricted keys. |
| Developer | Can usually create restricted keys; some accounts limit this to Administrators. |
-
1
Switch to test mode
Make sure the dashboard is in test mode or a sandbox for the first key.
You should see: A test mode or sandbox banner across the top of the dashboard.
-
2
Open API keys
Click Developers at the bottom left, then API keys (in Workbench it is the API keys tab).
You should see: Standard keys (publishable and secret) and a Restricted keys section.
-
3
Click Create restricted key
Click Create restricted key. If asked how the key will be used, choose the option for your own integration or a third party, whichever fits.
You should see: A form with a Key name field and a list of resources, each with None, Read and Write.
-
4
Name the key
Enter a name that says who holds it, such as Coding agent or Stripe MCP, so you know what to revoke later.
You should see: The name filled in.
-
5
Set the permissions
Leave every resource at None except the ones the agent needs. For example set Products and Prices to Read, or to Write if it should create them.
You should see: Only the resources you chose set to Read or Write.
-
6
Click Create key
Click Create key at the bottom. Stripe may ask you to confirm with your password or a code.
You should see: The new key listed under Restricted keys, with a value starting rk_test_.
-
7
Copy the key to the agent
Click Reveal or Copy on the key and put it in the agent's or MCP server's environment, such as STRIPE_SECRET_KEY=rk_test_xxx. Never paste it into chat or commit it.
You should see: The agent's first read call, such as listing products, succeeds.
If it does not work
The agent gets a permission error naming a rak_ permission. The key lacks that resource. Edit the key under Restricted keys and raise the named resource to Read or Write.
The key works in test but the agent fails against live data. Test and live keys are separate. Create a restricted key in live mode with the same permissions.
You cannot find the key's value anymore. Live keys are shown once. Roll the key or create a new one, update the agent, and delete the old key.
A key leaked into a repository or a chat. Roll it immediately from the key's menu, which invalidates the old value, then check the account's logs for calls you did not make.
Questions
What is the difference between an sk_ key and an rk_ key?
An sk_ secret key can do everything the API allows on the account. An rk_ restricted key can only do what you ticked for it. Give agents and third party tools an rk_ key.
Which permissions does the Stripe MCP server or an agent need?
Only what its tasks use. To look up products and prices, set Products and Prices to Read. To create payment links or customers, set those to Write. Leave everything else at None and add more when a call is refused.
What happens when the key lacks a permission?
The API refuses the call with a permission error that names the missing permission, such as rak_product_write. Edit the key and raise that one resource.
Can I see the key again after creating it?
In live mode Stripe shows a new key once, then hides it. Copy it straight into the agent's secret store. If you lose it, roll the key or create another.
Should the agent get a test mode or live mode key?
Test mode while you build. A test key starts rk_test_ and a live key starts rk_live_. Create the live key as a separate step when you trust what the agent does.
How we checked
Verified 11 Oct 2026 against the live interface on not walked yet.
Related guides
Ready to do it?
Run these 7 steps on your own Stripe page. Each step shows in a panel on the page, Next when you are ready.