Detection reference · Credentials and secrets · Updated 2026-11-03
Stripe keys: secret, restricted, test, publishable and webhook
Stripe issues keys that look alike but carry very different risk. A publishable key is meant to sit in a web page; a secret or restricted key moves money and reads customer data. Redaxa separates them by prefix.
At a glance
| Reported as | API key or token |
|---|---|
| Category | Credentials and secrets |
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Where it runs | The same engine runs in the Chrome extension (free checks, on your device), in the web check and the Windows app (on Redaxa's server; the text is not stored) and in public repository checks. |
| Engine rule | scanner.ts, line 205 |
What it looks like
sk_live_, sk_test_, rk_live_, rk_test_ and pk_live_/pk_test_ followed by at least 10 letters or digits; webhook signing secrets are whsec_ followed by at least 32.
Example 1
You paste
STRIPE_SECRET_KEY=sk_live_RedaxaDocsSampleNotRealR
Redaxa returns
STRIPE_SECRET_KEY=[SECRET]
| Reported as | API key or token |
|---|---|
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Probable service | Stripe |
| Credential type | Secret API key |
| Evidence | Stripe-style prefix identifies the key category, not its account or validity. |
| Recommended action | Revoke or rotate if genuine |
Example 2
You paste
stripe.api_key = "rk_live_RedaxaDocsSampleNotRealR"
Redaxa returns
stripe.api_key = "[SECRET]"
| Reported as | API key or token |
|---|---|
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Probable service | Stripe |
| Credential type | Restricted API key |
| Evidence | Stripe-style prefix identifies the key category, not its account or validity. |
| Recommended action | Revoke or rotate if genuine |
Example 3
You paste
STRIPE_SECRET_KEY=sk_test_RedaxaDocsSampleNotRealR
Redaxa returns
STRIPE_SECRET_KEY=[SECRET]
| Reported as | API key or token |
|---|---|
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Probable service | Stripe |
| Credential type | Test-mode secret key |
| Evidence | Stripe-style prefix identifies the key category, not its account or validity. |
| Recommended action | Revoke or rotate if genuine |
Example 4
You paste
STRIPE_WEBHOOK_SECRET=whsec_RedaxaDocsSampleNotRealRedaxaDoc
Redaxa returns
STRIPE_WEBHOOK_SECRET=[SECRET]
| Reported as | API key or token |
|---|---|
| Severity | critical: direct account or system compromise, as with keys, passwords and tokens |
| Replaced with | [SECRET] |
| Probable service | Stripe |
| Credential type | Webhook signing secret |
| Evidence | Stripe webhook-secret prefix; endpoint and validity are not verified. |
| Recommended action | Revoke or rotate if genuine |
All values on this page are synthetic or published specimens; none is a working credential or a real person's data.
In a repository check
The same example, committed to a public repository and run through the free repository check:
server/payments.js: API key or token, listed for review (severity critical). Credential pattern matched. Validity is not tested; review and rotate if genuine.- Same value in
tests/fixtures/payments.js: Test or example value, counted but not listed. Real-looking keys in test files are still reported.
Values are always shown masked in repository reports. No key is ever tested against its provider.
What it does not flag
const stripe = Stripe("pk_live_RedaxaDocsSampleNotRealR"): not flagged. A publishable key is a public client identifier. Prompt checks skip it; repository checks list it as a reference, not an exposure.
If it already leaked
Roll the secret or restricted key in the Stripe Dashboard (Developers, API keys); for a webhook secret, roll it on the endpoint's page. Then check recent API requests and events for activity you did not cause.
What Redaxa adds to every finding of this kind: If genuine, revoke or rotate it at the issuing service, update the application, then remove the exposed value from code and review Git history. Deleting it from Git does not revoke access.
Official guidance: docs.stripe.com, docs.stripe.com.
Step by step: pasted a key into ChatGPT, or committed one to GitHub.
Check before you paste
The free Chrome extension runs this check inside ChatGPT, Claude, Gemini and Perplexity before a message is sent, on your device and with no daily limit. On the web you get 5 free prompt checks a day with no account.
Add the Chrome extensionTry a free web checkWorried it is already in your code? Check a public GitHub repository free (3 checks a day).
Related
- GitHub tokens
- GitLab personal access tokens
- OpenAI API keys
- Anthropic API keys
- Supabase keys
- Slack tokens and webhook URLs
- Google API keys
- AWS access keys
- npm access tokens
- PyPI API tokens
- Hugging Face access tokens
- SendGrid API keys
- JSON Web Tokens (JWT)
- Bearer tokens
- Passwords in URLs
- Secrets in configuration values
- Passwords written in text
- Private keys (PEM)
- I pasted an API key into ChatGPT: what to do
- Stop API keys leaking into AI prompts
- Check a public GitHub repository for leaked API keys
- Free GitHub secret scanner
- Everything Redaxa detects
Sources
- Redaxa engine: scanner.ts line 205, credential-context.ts line 33 (Stripe). Every output on this page was produced by that code when the page was built.
- Stripe Docs: API keys
- Stripe Docs: Webhooks