Which Stripe API key is used on the server-side and must be kept secret?

Which Stripe API key is used on the server-side and must be kept secret?

• A. Publishable Key pk_
• B. Secret Key sk_
• C. Test Mode _test_
• D. Live Mode _live_

Answer: (B)

The key concept here is that sensitive account actions to Stripe should be done with a secret key that lives on your server. Stripe provides two main kinds of keys: publishable keys for client-side use and secret keys for server-side use. The secret key (sk_ prefix) is what your backend uses to authenticate requests that can create charges, customers, refunds, and other privileged operations. Because it can access and modify billing data, it must never be exposed in client-side code or in public repositories; store it securely (for example, in environment variables or a secrets manager) and rotate it if needed. There are separate keys for test mode and live mode, so you use the test secret key during development and switch to the live secret key in production. Publishable keys (pk_ prefix) are designed to be safe to expose to the client and are used only for non-privileged operations, such as tokenizing card details with Stripe.js.

The key concept here is that sensitive account actions to Stripe should be done with a secret key that lives on your server. Stripe provides two main kinds of keys: publishable keys for client-side use and secret keys for server-side use. The secret key (sk_ prefix) is what your backend uses to authenticate requests that can create charges, customers, refunds, and other privileged operations. Because it can access and modify billing data, it must never be exposed in client-side code or in public repositories; store it securely (for example, in environment variables or a secrets manager) and rotate it if needed. There are separate keys for test mode and live mode, so you use the test secret key during development and switch to the live secret key in production. Publishable keys (pk_ prefix) are designed to be safe to expose to the client and are used only for non-privileged operations, such as tokenizing card details with Stripe.js.