Create a restricted key
A restricted key can only do what you allow it to do. This walks through creating one in the Stripe Dashboard with exactly the read permissions SSA needs, then connecting it.
Create the key in Stripe
In the Stripe Dashboard, go to Developers > API keys.
stripe-key-step-1Click Create restricted key.
stripe-key-step-2Name the key (for example "SSA Analytics"), then set Read permission on Customers, Subscriptions, Charges, Invoices, and Products and Prices. Leave every other permission at None: SSA only ever reads.
stripe-key-step-3Click Create key.
stripe-key-step-4Stripe shows the full key exactly once. Copy it now; you cannot view it again after you leave the page.
stripe-key-step-5
Paste it into SSA
Open the setup wizard (it opens on its own the first time you activate SSA) or go to Settings > Payment Providers. Paste the key into Secret key (wizard) or Secret API Key (Settings). SSA reads the rk_test_ / rk_live_ prefix and picks the matching Test or Live mode for you.
Before saving anything, SSA checks the key by listing one record from each of Customers, Subscriptions, Charges, Invoices and Prices. If a permission is missing, the error names exactly which one, so you can go back to Stripe and grant it rather than guessing.