Stripe publishable key vs secret key: which can be public?
- Publishable keys (
pk_live_,pk_test_) are designed for the browser. They can start a checkout or collect card details but can't read your data or move money. - Secret keys (
sk_live_) can do almost anything in your account: refunds, customer data, and more. They must stay on a server. - Restricted keys (
rk_live_) are secret keys with limited permissions. Still server-only, but a leak does less damage.
If a secret key is in your site
- In the Stripe Dashboard → Developers → API keys, roll the key immediately.
- Review recent activity for refunds, payouts and customers you don't recognize.
- Move the code that needs it to a server function.
A simpler option
If you only sell a few things, Stripe Payment Links need no keys in your code at all. To confirm payments on a server, use a restricted key with only the read permissions you need.