Accounts and API keys

A Stripe account holds your catalog, customers and payments. Every account has a test mode: a full copy with its own data and its own keys, where test cards succeed and no money moves. Which mode you’re in is decided by the key you use.

AcmeStripe account

test modetest cards · no money movessk_test_…

products, pricestest data

webhookstest endpoints

live modereal customerssk_live_…

products, priceslive data

webhookslive endpoints

One account, two copies. The key you deploy with picks which one, and nothing created in test mode reaches live mode.

Deploy with a key in your profile

Alchemy deploys with a secret key, from Developers → API keys in the dashboard. Start with the test key, sk_test_…, and store it in a profile:

alchemy profile edit --add Stripe

See Setup.

Test mode for everything but production

A stage decides what you deploy. The key decides where. Deploy every development and preview stage with the test key, and only production with the live key, from its own profile:

alchemy profile create prod
alchemy profile edit --profile prod --add Stripe
alchemy deploy --stage prod --profile prod

Products, prices and webhooks created in test mode stay there, so previews never touch real customers.

Restricted keys: what an app should hold

A secret key can do anything in the account. A restricted key can do only what you list, like reading products or creating Checkout sessions.

Each Stripe binding your runtime uses declares the permission it needs, and Alchemy records them on a RestrictedApiKey for that runtime. Stripe has no API to create restricted keys yet, so the key a runtime gets is your secret key, with its permissions on record. To give it a narrower key, create one in the dashboard and pass it in:

alchemy.run.ts

const key = yield* Stripe.RestrictedApiKey("ApiKey", {
  value: Config.String("STRIPE_RESTRICTED_KEY"),
  permissions: ["customers_read"],
});

In CI

With CI=true, Alchemy skips the profile and reads STRIPE_API_KEY from the environment. See CI.