nullcipher

Stripe secret and restricted keys (sk_live_, sk_test_, rk_live_, rk_test_)

sk_live_, sk_test_, rk_live_ or rk_test_ plus 10+ letters and digits; public pk_ keys are left alone. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Stripe secret key

What an AI chat would receive after masking

[STRIPE_KEY_1]

1 × Stripe secret key found and masked.

How nullcipher recognises it

sk_live_, sk_test_, rk_live_ or rk_test_ followed by at least 10 letters and digits. Publishable pk_ keys are public and are left alone.

This is the rule text of the “Stripe secret key” detector in the masking engine, copied from the engine when this page was built. Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

sk_test_EXAMPLE000000000000000000000000

nullcipher replaces it with [STRIPE_KEY_1]. A sandbox-style prefix followed by EXAMPLE and zeros. Stripe never issued it.

Why it matters in an AI chat

Stripe describes a secret key (sk_) as an API key with unrestricted permissions for all Stripe APIs, and warns that a fraudulent party who gets one can harm your business. Restricted keys (rk_) carry only the permissions you gave them, but Stripe still lists them as not safe to expose.

Live keys (sk_live_, rk_live_) act on real payments and real customer records. Sandbox keys (sk_test_) cannot move real money, since card networks do not process sandbox payments, but they still open your test data and settings.

Publishable keys (pk_) are designed to sit in front-end code. nullcipher does not mask them, so the AI can still see which one your checkout uses.

If it already leaked

  1. Open the API keys page in the Stripe Dashboard, open the ⋯ menu next to the key and choose Rotate key. Rotating revokes the key and generates a replacement that is ready to use immediately. [1][2]
  2. Pick the old key's expiry in the rotate dialog. Choosing Now deletes the old key at once; any later time keeps both keys working until then (up to 7 days when you rotate in the Dashboard). For a key that has leaked, Now is the safe choice. [1]
  3. Put the new key in your backend and confirm in the request logs that the new key is the one being used. [2]
  4. Review recent activity in Workbench, refund fraudulent charges, pause or reject connected accounts and payouts you do not recognise, and rotate your other secret and restricted keys as a precaution; all of this is on Stripe's own checklist. [2]
  5. Stripe suggests restricted keys for most uses and access policies that limit a key to your own servers, so that a future leak is worth less. [1]

Sources

  1. API keys — Stripe Documentation — checked 2026-09-23.
  2. Protecting against compromised API keys — Stripe Support — checked 2026-09-23.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 16 secret types and how to delete a chat you already sent.