Home / Guides / Is my Stripe secret key exposed?

Is my Stripe secret key exposed? How to check in 2 minutes

Stripe has publishable keys (pk_…) meant for browsers, and secret keys (sk_…), restricted keys (rk_…) and webhook signing secrets (whsec_…) that must stay on a server. Here's how to check which ones your live app exposes.

Scan your live app free Passive, no signup, never touches your database.

1. Scan your live URL

Unspill downloads your page and its JavaScript bundles and looks for sk_, rk_ and whsec_ patterns, then shows a masked match (first characters + last 4) so you can identify which key it is. Note: Clerk also uses the sk_live_/sk_test_ prefix for its secret keys; the fix is the same.

2. Check in your browser

Open your app, then DevTools → Sources (Chrome) or Debugger (Firefox), and search all files (Ctrl/Cmd+Shift+F) for sk_live, sk_test, rk_live and whsec_.

3. Check your build output

Search the files your build produces:

# after building locally (Vite: dist/, Next.js: .next/static/)
grep -rEo "sk_(live|test)_[0-9A-Za-z]{10}|rk_(live|test)_[0-9A-Za-z]{10}|whsec_[0-9A-Za-z]{10}" dist/ .next/static/ 2>/dev/null

4. Check your env variable names

Any Stripe secret in a VITE_ or NEXT_PUBLIC_ variable is shipped to browsers. Only the publishable key should be public.

5. If you find one: roll it

Stripe Dashboard → Developers → API keys → roll the key, move Stripe calls into a server function, then review Developers → Logs for requests you didn't make. Full steps are in our Stripe fix guide.

6. Reduce blast radius

Stripe recommends restricted API keys with only the permissions a service needs. Use them for anything that isn't your main backend.

Fix guides for these issues

Stripe secret key exposed: A Stripe sk_live_ or sk_test_ key in your JavaScript lets anyone create charges, issue refunds and read your customers. Roll the key in the Stripe Dashboard and move payments server-side.
Possible hard-coded secret: Variables named secret, token, password or apiKey with long random values in front-end code are often real credentials. Check each one, rotate real secrets, and keep them server-side.
Exposed .env file: If https://yourapp.com/.env downloads your environment file, every secret in it is public. Remove it from the deployed output, block dotfiles, and rotate every key.

FAQ

Is my Stripe publishable key (pk_live_) a problem?

No. Publishable keys are designed to be used in browsers.

I only exposed a test key (sk_test_). Does it matter?

Less, since test mode has no real money, but it still gives access to your test-mode data and settings. Roll it, and fix the code before a live key ends up in the same place.

Sources

Last checked against these sources on 2026-10-19. Platforms change; when in doubt, the official docs win.