Stripe Restricted Key picker

What the picker is, what it isn't

It maps ten common AI-agent Stripe operations to the smallest Restricted Key permission set that still lets each operation succeed against Stripe's current API. The mapping is hand-curated against the resource list in the Stripe Dashboard's Create restricted key form, not auto-generated, so it tracks Stripe's intended grouping rather than the raw resource list.

It does not replace a per-day USD cap, an audit log of what the key actually moved, or a sub-second revoke. Restricted Keys cap which resources and verbs are reachable; they don't cap the dollars per minute that flow through them. A key with Charges Write still permits unlimited charges until you revoke it. The blast-radius tier on each scope is the bound on what an attacker could move in 60 seconds at Stripe rate limits — not what real production traffic looks like.

For an honest read on what Restricted Keys cover and where they fall short across the ten controls engineers actually want, see the ten-control coverage matrix — three Yes, two Partial, five No. The five No items are why this picker exists alongside Keybrake.

Three steps from picker to live key

1. Tick every operation your agent calls in production. Skip operations you might add later — the smallest reachable scope is always the right starting point. You can edit the key later.
2. Read the right column. Each row is a resource (e.g. Charges) plus a permission verb (Read or Write) and a blast-radius tier. Note any rows tagged EXTREME — those grant irreversible cash-exfil paths and should be the first thing you cap externally.
3. In the Stripe Dashboard, go to Developers → API keys → Create restricted key. Untick the default permissions, then tick only the resource-permission pairs from the right column. Save, copy the rk_live_ (or rk_test_) value into your agent's secret manager, and rotate the key on whatever cadence your incident response calls for.

Background reading

• Stripe Restricted API Key permissions: 30-row map with runaway risk per resource — the long-form companion to this picker, with the per-resource breakdown the picker collapses into ten use cases.
• Working Restricted Key example for a refund-issuing support agent — a single use case walked end-to-end, including the Webhook Endpoints gotcha.
• How to create a Stripe Restricted API Key — 4-step Dashboard walkthrough — the Dashboard mechanics, with screenshots referenced.
• How to give an AI agent a Stripe API key without setting your money on fire — the controls picture: scope, cap, revoke, audit.
• Agent blowout calculator — what 24 hours of a stuck agent costs per vendor, and what a per-vendor cap stops it at.