00 / free tool
Stripe test vs live key checker
Paste the first 8 characters of a Stripe key, like sk_live_. See whether it's test or live, what kind of key it is, and whether it's in a place it shouldn't be. Never paste a whole secret.
01 / check your keys
Paste only the first 8 characters, like sk_live_. Never paste a whole secret key anywhere. You can add the env var name in front (NAME=sk_live_) to check where the key lives. Nothing you type is sent or saved.
02 / how stripe keys are named
a
Test and live
Test (sandbox) keys start with pk_test_, sk_test_ or rk_test_. Live keys start with pk_live_, sk_live_ or rk_live_. Each mode has its own keys and its own objects, so a test price ID won't work with a live key. Stripe: API keys
b
Which key goes where
Only publishable keys (pk_) are safe in browser code. Secret keys (sk_), restricted keys (rk_) and organization keys (sk_org_) stay on your server, in env vars or a secrets vault. Stripe recommends restricted keys over secret keys for new uses. Stripe: managing secret API keys
c
Webhook signing secrets
A whsec_ value isn't an API key. It belongs to one webhook endpoint, and the prefix doesn't show the mode. When you go live, add the endpoint in live mode and use its new secret. Stripe: webhooks Stripe: go-live checklist The signature checker tests the secret against a real delivery.
03 / questions
- How do I tell a Stripe test key from a live key?
- By the prefix. Test (sandbox) keys start with pk_test_, sk_test_ or rk_test_. Live keys start with pk_live_, sk_live_ or rk_live_.
- Which Stripe key can go in browser code?
- Only the publishable key (pk_). Secret keys (sk_), restricted keys (rk_) and webhook signing secrets (whsec_) stay on the server. In Next.js, Vite or Expo, don't put them in a NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_ variable, because those are copied into the browser bundle.
- Is whsec_ a test or live secret?
- The prefix doesn't say. Each webhook endpoint has its own signing secret, and the Stripe CLI prints another for stripe listen. Your live endpoint's secret is different from your test one, so copy it from the live endpoint in Workbench.
- Why do I get 'a similar object exists in test mode, but a live mode key was used'?
- Your keys and your IDs are from different modes, for example a test price ID with a live secret key, or a test publishable key with a live secret key. Each mode has its own keys and objects.
- I pasted my whole secret key. What now?
- This page didn't send or save it, but treat any secret you've pasted outside your server as exposed. Rotate it on the API keys page in the Stripe Dashboard and update your env var. For a whsec_, roll the endpoint's secret in Workbench, Webhooks.
- Does this tool send anything?
- No. It checks the text in your browser by its prefix. It makes no network requests and doesn't store what you type.
04 / catch it next time
The right keys are step one. Step two is knowing when checkout stops working anyway. CheckoutAlarm reads your Stripe account with a read-only restricted key and emails you when webhook events are still undelivered after about 15 minutes, when an endpoint gets disabled, or when sales stop.
Free: 1 site, checked once a day. Pro: $19 a month for up to 3 sites, checked hourly. We only check sites you prove you own, and for Stripe we only take a read-only restricted key. Compare plans
Watch my app freeFree for one app. Checked every day. No card needed.
05 / more free tools
- Stripe webhook signature checkerPaste the raw body, the Stripe-Signature header and your whsec_ secret. See if they match and why not. Runs in your browser.
- Stripe webhook error decoderPaste a webhook error or an Event deliveries status (400, 401, 307, timed out). Get what it means and the fix.
- Webhook outage cost calculatorHow much money passed through while your webhook was broken, what Stripe will still retry, and whether a quiet spell in sales is normal.
- Stripe webhook event checklistPick one-time Checkout, subscriptions, Connect or invoices. Get the events to subscribe to, what each means, common mistakes and a checklist to copy.