Create a Restricted Read-Only Stripe API Key for Reporting

Why the standard secret key is the wrong choice

Stripe's standard secret key (starting sk_) can do everything your account can do: charge cards, issue refunds, create and cancel subscriptions, delete customers. Pasting that key into a spreadsheet add-on, a script, or a third-party dashboard means every one of those actions is one bug or one leaked credential away from happening by accident. A tool that only exports data for a report has no reason to hold write access at all.

What a restricted key is

Stripe's restricted keys (starting rk_) let you grant permission resource by resource, and separately for read and write, instead of all-or-nothing. A key can be set to "Read" on Charges, Payouts, Invoices, Customers, and Subscriptions, and "None" on everything else, including anything that moves money. If that key ever leaks, it can be used to look at data, not to charge a card or change a subscription.

Creating one

1. In the Stripe Dashboard, go to Developers → API keys.
2. Choose Create restricted key.
3. Set Balance to Read. Most reporting tools validate the connection with a balance check before doing anything else, so this permission is usually required even if you never export balance data directly.
4. Set Read for each resource you actually plan to export: Charges, Payouts, Invoices, Customers, Subscriptions, or whichever subset you need.
5. Leave every other resource, and every Write permission, set to None.
6. Save the key and copy it immediately. Stripe shows the full value only once.

What to do if it leaks anyway

A restricted read-only key limits the damage, but it isn't nothing: it still exposes whatever data it can read. If a key is ever exposed, roll it from the API keys page immediately rather than waiting to see if anything looks wrong, and check the Stripe Dashboard's API request logs for activity you don't recognize.

Once the key is connected

See how to export Stripe transactions to Google Sheets for what to do with the connection once it's working.