How to rotate a Stripe secret key without downtime

Rotate the key from the API keys page of the Stripe Dashboard and choose an expiration date instead of Now. Stripe issues the replacement at once and keeps the old key working for up to 7 days, so you can move every service before anything breaks (Stripe Docs). Put the new value where your services read it, restart them, watch the old key's request logs fall to zero, and only then let it expire. If a week is too short, create a second key by hand, move to it at your own pace, and expire the first one afterwards.

Crunu doesn't reissue keys at Stripe or at any other provider. It shows which values a departing person or a leak exposed, keeps the new key as a new version of the environment, and restarts the programs that read it. The rotation itself always happens in your Stripe Dashboard.

Which Stripe key you are reissuing

Stripe has four kinds of API keys, and they don't carry the same risk:

• Secret key, sk_live_…: unrestricted permissions on all Stripe APIs of the account. Most older backends use one, and it is the subject of this page.
• Restricted key, rk_live_…: only the permissions you grant. Stripe recommends restricted keys for most uses and suggests moving secret-key integrations to them. They rotate the same way, and the replacement keeps the rotated key's name.
• Organization key, sk_org_…: acts at the level of a Stripe organization that manages several accounts at once.
• Publishable key, pk_live_…: built for front-end code. It can be rotated but not expired, and seeing it gives nobody new powers.

Webhook signing secrets are separate from API keys. Every webhook endpoint has its own, under Webhooks in the Dashboard, so reissue those as well if the person could read them. Sandbox keys start with sk_test_ and rk_test_ and reach only test data, which is why live keys come first.

Reissue without downtime

On a server, the service line looks like this. After a new version arrives and 2 seconds pass without further changes, crunu sends the program SIGTERM and starts it again with the new variables:

crunu run --env payments-api/production --restart on-change -- /opt/payments/bin/server

When to reissue a Stripe key

Stripe's own list of reasons to rotate a key covers the cases that matter for a team:

• Someone leaves or changes roles. Stripe names this explicitly. In Crunu, removing the person produces an exposure report and a reissue checklist, and STRIPE_SECRET_KEY appears on the checklist if a version they received still holds the current value.
• A leak. If the key may be compromised, don't keep it alive for a week. Rotate with Now, which deletes the old key at once, and accept a short interruption while services restart.
• A schedule. If your policy requires rotation at fixed intervals, Stripe can also schedule a key to rotate after a set time.
• A lost key. A live key you created yourself can't be revealed again, so losing it means rotating it.

The full order of work for a departure, including what to cut off before you get to providers, is in What to rotate when a developer leaves. The offboarding checklist builds the list of values for your own stack.

Make the next reissue smaller

A secret key that every service shares turns one departure into an account-wide change. A few habits keep the next round small:

• One restricted key per service. When a key leaks or someone leaves, you reissue a key with known permissions and a known consumer, not the key behind everything.
• Access policies. Stripe can tie a key to IPv4 addresses and CIDR ranges, or to allowed ASNs and countries, and can block anonymous VPNs, public proxies and Tor exit nodes. Requests from elsewhere are blocked and you are notified. Stripe recommends a policy on every live key.
• A note on every key. The Dashboard asks where you saved a new key. Writing the Crunu project, environment and variable name there tells the next person exactly which value to replace.

Crunu keeps the paper trail on its side: each saved version carries an author and a time, and Where to reissue next to Stripe values in the reissue checklist links to the Dashboard. Calling Stripe, rotating the key and expiring the old one remain your steps.