How to securely store Stripe secret keys

1# .env file (DO NOT commit this file)
2STRIPE_SECRET_KEY=sk_test_51ABC123...
3STRIPE_PUBLISHABLE_KEY=pk_test_51ABC123...
4STRIPE_WEBHOOK_SECRET=whsec_ABC123...

1# .gitignore
2.env
3.env.local
4.env.production
5.env.*.local
6node_modules/

1// Install dotenv: npm install dotenv
2require('dotenv').config();
3
4const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
5
6// Verify key is loaded (never log the actual key)
7if (!process.env.STRIPE_SECRET_KEY) {
8  console.error('ERROR: STRIPE_SECRET_KEY not set');
9  process.exit(1);
10}
11
12console.log('Stripe initialized with key ending in:', 
13  process.env.STRIPE_SECRET_KEY.slice(-6));

1// Using a restricted key that can only create charges
2const stripeChargesOnly = require('stripe')(process.env.STRIPE_RESTRICTED_KEY);
3
4// This works — charges permission is granted
5async function createCharge() {
6  const pi = await stripeChargesOnly.paymentIntents.create({
7    amount: 5000,
8    currency: 'usd',
9    payment_method_types: ['card'],
10  });
11  return pi;
12}
13
14// This would fail — customer permission not granted
15// const customers = await stripeChargesOnly.customers.list(); // Error!

1// After rotating your key in the Dashboard:
2// 1. Update the key in your environment variables / hosting platform
3// 2. Restart your application to pick up the new key
4// 3. Test that payments still work
5
6// Verify the new key is active
7async function verifyKey() {
8  try {
9    const balance = await stripe.balance.retrieve();
10    console.log('Key is valid. Balance available:', balance.available);
11  } catch (err) {
12    console.error('Key verification failed:', err.message);
13  }
14}
15
16verifyKey();