AppInspected

Fix guides

Your Stripe secret key is public. Rotate it before anyone uses it.

Last reviewed October 15, 2026 against the providers' current documentation.

The short version

Rotate the key in the Stripe Dashboard now, even if you're not sure anyone saw it. Stripe lets the old key keep working for a short time you choose, so you can switch your server over without breaking checkout. Then move every Stripe call that uses the secret key to your server.

Why it matters

A secret key (sk_live_…) or restricted key (rk_live_…) is the password to your Stripe account. With it, someone can issue refunds, read customer details and change your account. Bots scan public code for these keys constantly. Publishable keys (pk_live_…) are different: they're meant to be in your frontend.

Fix it, in this order

  1. Rotate the key

    In the Stripe Dashboard, go to Developers → API keys. Click the … menu next to the exposed key and choose Rotate key. Pick an expiration for the old key that's just long enough to update your app, such as one hour.

  2. Put the new key on your server only

    Store the new key in your server's environment variables or secrets manager. Never put it in a VITE_… or NEXT_PUBLIC_… variable, which gets copied into the browser.

  3. Move Stripe calls out of the browser

    Creating payments, checkout sessions, refunds and customers must happen on a server: a Next.js API route, a Supabase Edge Function or your backend. The browser should only use the publishable key, for example with Stripe Checkout or Stripe Elements.

  4. Confirm the new key works, then delete the old one

    Use the … menu on the new key and open View request logs to confirm your app is using it. Then delete the old key; deletion takes effect immediately.

  5. Look for damage

    Check your request logs and payments for charges, refunds or connected accounts you don't recognize. Refund fraudulent charges and contact Stripe support if money was moved.

Or ask your AI tool to do it

Paste this into Lovable, Bolt, Cursor, Claude Code or whichever tool built your app. Review what it changes before you deploy.

My Stripe secret key was exposed in frontend code. Move every Stripe operation that uses the secret key (creating checkout sessions, payment intents, customers, refunds) into server-side code, such as an API route or edge function. Read the key from a server-only environment variable called STRIPE_SECRET_KEY. The frontend must only use the publishable key. Do not put the secret key in any VITE_ or NEXT_PUBLIC_ variable. Also verify webhook signatures on the server.

How this happens

The Stripe examples an AI tool learned from often call the API directly, and in a single-page app the simplest place to put that call is the browser. The secret key comes along with it.

Check that it's really fixed

After you deploy, run the free check. It reads your live site the way an attacker would and tells you if any secret key is still visible.

Check my app free

Questions

Stripe emailed me about an exposed key. Is it real?

Stripe does detect some exposed keys and may notify you or expire the key itself. Check by logging into the Dashboard directly, not through a link in the email.

Is my publishable key a problem?

No. Publishable keys are designed for webpages and apps.

Sources

Related guides