Create a read-only Stripe key in 60 seconds

Stripe has three kinds of API key. A publishable key (pk_live_…) is public and only creates tokens. A secret key (sk_live_…) can do everything: refund, create charges, delete data. A restricted key (rk_live_…) can do only what you allow. For any analytics tool, Glow included, the right answer is a restricted key with Read permissions.

Step by step

1. Sign in to the Stripe Dashboard and open Developers → API keys (dashboard.stripe.com/apikeys).
2. Click Create restricted key. If Stripe asks how you’ll use it, choose “Providing this key to another website”.
3. Name it so you’ll recognise it later: Glow (read-only).
4. Set Read on: Balance, Balance transaction sources, Charges, PaymentIntents, Refunds, Disputes, Products, Prices, Subscriptions, Invoices.
5. Leave everything else at None, including Customers. Glow doesn’t need your customers’ names or emails.
6. Click Create key, confirm with Stripe’s 2FA, and copy the value. Stripe shows it once.
7. Paste it into Glow. Glow seals it immediately and never shows it again.

How to check a key is really read-only

Open the key in Stripe and look at its permission list: every row should say Read or None. Glow also checks for you: it reads your balance and subscriptions, then tries three writes that can’t succeed (creating a product with no name, updating a customer that doesn’t exist, a refund with no charge). Each must come back as a permission_error. If any write gets further, Glow refuses the key and tells you which permission to remove.

Rotate or revoke

In Developers → API keys, open the key and choose Roll key or Delete. In Glow, replace the key from Connections. Your history stays.