Standard keys versus restricted keys
Stripe issues two shapes of secret key. SSA accepts either one, but only one of them lets you limit what it can see.
Standard keys
A standard secret key (prefixed sk_test_ or sk_live_) has full read access to your Stripe account by default. It passes every permission check SSA runs without needing anything configured.
Restricted keys
A restricted key (prefixed rk_test_ or rk_live_) only has the permissions you granted it when you created it. SSA checks a restricted key against five resources and tells you by name if one is missing:
- Customers
- Subscriptions
- Charges
- Invoices
- Products and prices (read): specifically Prices. Products read is optional and only affects plan names.
See Create a restricted key for the exact steps in the Stripe Dashboard.
Why SSA asks for read-only
Every permission SSA asks for is Read. Its connection check only lists records; nothing in SSA ever creates, changes or deletes anything in your Stripe account. A read-only restricted key is the recommended choice for exactly that reason: it can show SSA your subscription data and nothing else.
The prefixes SSA accepts
sk_test_: a standard key, test modesk_live_: a standard key, live moderk_test_: a restricted key, test moderk_live_: a restricted key, live mode
Each prefix must be followed by at least 20 alphanumeric characters. Anything else is rejected before SSA even contacts Stripe.