What happens if you expose your secret API key?

What happens if you expose your secret API key?

• A. Your account will be suspended automatically.
• B. Anyone could perform API calls as you.
• C. Keys become rotated automatically.
• D. Webhooks will stop delivering.

Answer: (B)

Secrets keys are what your app uses to prove it’s really you when making requests to Stripe. If someone else gets that secret key, they can authenticate as your account and perform any action your key allows. That means they could create charges, refund or capture funds, modify or read customer data, and run other API calls as if they were you. In short, exposure lets an attacker act with your privileges, which is a major security risk and needs immediate action. Since keys don’t rotate automatically when exposed, you should treat this as a breach: revoke the compromised key, generate a new one, and update your integration to use the new key. Then review recent activity for anything suspicious and tighten your security practices (keep keys out of code, use environment variables, and consider extra protections Stripe offers). The other options don’t fit because exposure doesn’t automatically suspend your account, keys don’t rotate on their own, and webhooks continue to deliver as usual—they are a separate mechanism and aren’t disrupted simply by exposing a secret key.

Secrets keys are what your app uses to prove it’s really you when making requests to Stripe. If someone else gets that secret key, they can authenticate as your account and perform any action your key allows. That means they could create charges, refund or capture funds, modify or read customer data, and run other API calls as if they were you. In short, exposure lets an attacker act with your privileges, which is a major security risk and needs immediate action.

Since keys don’t rotate automatically when exposed, you should treat this as a breach: revoke the compromised key, generate a new one, and update your integration to use the new key. Then review recent activity for anything suspicious and tighten your security practices (keep keys out of code, use environment variables, and consider extra protections Stripe offers).

The other options don’t fit because exposure doesn’t automatically suspend your account, keys don’t rotate on their own, and webhooks continue to deliver as usual—they are a separate mechanism and aren’t disrupted simply by exposing a secret key.