How to restrict API Key to certain ip addresses?

[rajhlinux]

Is there a way on the IPGeolocation platform to restrict all requests except to a specific IP Address?

[theghostinvisible]

Restricted API keys

Use restricted API keys to control your application's access to the Stripe API.

You can use a restricted API key (RAK) to assign specific Stripe API permissions to your API keys. Using a RAK limits the potential damage to your business if an API key is exposed to a bad actor. If a restricted API key doesn’t have the correct permissions to complete an API request, Stripe returns an invalid request error.

What is a restricted API key?

When you sign up for Stripe, you get a secret API key (starts with sk_live_ or sk_test_). Any person, agent, or system with your secret key can do anything in your Stripe account: create charges, issue refunds, read customer data, trigger payouts, and more.

A restricted API key (RAK) starts with rk_live_ or rk_test_ and can do only what you choose. When you create a RAK in the Stripe Dashboard, you select which Stripe resources the key can access and the permissions for each resource: Read, Write, or None. All Stripe APIs support restricted API keys.

You can use RAKs as a defensive measure to protect your Stripe account in case your keys are exposed or compromised. If a bad actor obtains a RAK, they’re limited to that key’s permissions. For example, you could create a RAK that can only read dispute data and nothing else. If a bad actor obtained that key, they could only read dispute data. They couldn’t create charges, access customer payment methods, or trigger payouts.

Stripe recommends always using RAKs instead of unrestricted secret keys, especially when giving a key to an AI agent. Use RAK permissions to limit what an agent can do in your account.

Always follow best practices when using RAKs to avoid accidental exposure or compromise. Treat RAKs with the same caution as secret API keys.

Why use restricted keys instead of secret keys?

	Secret key (sk_)	Restricted key (rk_)
Scope of access	Full access to every API resource	Only the permissions you assign
Impact if compromised	A bad actor can do anything in your account	A bad actor can do only what the key allows
Suitability for AI agents	An agent might do things you don’t want in your account	You explicitly control the agent’s permissions
Third-party sharing	Dangerous: gives full control to the third party	Safer: you hand out only the access the third party needs
Principle of least privilege	Not possible to achieve with unrestricted keys	You can give keys minimal permissions
Compliance	You can control who has access to your keys, but not what the keys can do	You can control who has access to your keys, and you control what those keys can do
Stripe recommendation	Use sparingly and protect aggressively	Preferred: Use restricted keys wherever possible

Create a restricted API key

1. On the API keys tab, do one of the following:
   • To create a new restricted key, click Create restricted key.
   • To clone an existing key, click the overflow menu (⋯), then select Duplicate key for the key you want to clone. The default value for each permission is the value from the cloned key.
2. If you’re creating a new key, you can choose from a preconfigured set of permissions or start from zero permissions.
3. Enter a name in the Key name field. If you cloned an existing key, the default name is the cloned key’s name.
4. For each resource you want the new key to access, select the appropriate permission: None, Read, or Write. If you use Connect, you can also select the permission to allow for this key when accessing connected accounts. The default value for all permissions is None.
5. Click Create key.
6. In the dialog, complete the two-factor verification we send you.
7. Click the key value to copy it.
8. Save the key value. You can’t retrieve it later.
9. In the Add a note field, enter the location where you saved the key, then click Done.

Migrate from a secret key to a restricted key

In your server environment, restricted API keys are drop-in replacements for secret API keys. To use a restricted API key, provide it to your code in the same way you provide your secret key, following best practices to avoid accidentally exposing the key. Every Stripe API supports restricted API keys. You need to configure each restricted key’s permissions to get the benefits.

The following sections describe a step-by-step approach to migrate from a secret key to a restricted key. See Assign permissions to a restricted API key to understand how to reduce a restricted key’s permissions.

Create a restricted API key in a sandbox

Create a restricted API key in a sandbox before creating a live-mode key.

1. On the API keys page in the Stripe Dashboard, click Create restricted key.
2. Give the new key a descriptive name, such as billing-service-test.
3. Don’t give the key any permissions yet. You set the permissions after reviewing the secret key’s existing usage.

Review the secret key’s API usage

Use the secret key’s existing API usage as a baseline to set the permissions for a RAK.

• Review your code and any third-party integrations to catalog the Stripe products you use and the API calls you currently make with your secret key.
• Review the secret key’s request logs to see successful API requests.

Use the table below to map successful API requests to the permissions your RAK needs. For each resource, set the permission to None, Read, or Write based on the API usage you observed. Write permissions imply read permissions: any key that can write an API resource can also read that resource.

HTTP method	RAK permission type
GET	read
POST	write
DELETE	write

For example, if you see successful calls to GET /v1/customers with your secret key, you need to add read permissions for the Customer resource to the replacement RAK’s permissions.

Configure your staging environment to use the restricted key

In your test or staging application, replace the secret key with the restricted key in your server environment (for example, in a secrets vault, or an environment variable if your platform doesn’t provide a secrets vault). The Stripe SDK and HTTP calls that use your key work identically. The only difference is the key value.

Review the restricted key’s request logs for errors and adjust permissions

Review the restricted key’s logs in test mode from the key list by clicking the overflow menu (⋯) next to the key and selecting View request logs.

If you find any error messages such as 403 ERR, edit the restricted key’s permissions to add the actions that failed:

1. Click the overflow menu (⋯) next to the key.
2. Select Edit key.
3. Repeat your tests in a sandbox to confirm that you have assigned the restricted key the correct permissions.

Check your application logs for Stripe API errors. If the restricted key sent with a request doesn’t have the correct permissions, the response body includes an error message explaining which permissions to add.

Create a live-mode restricted key

Create a new restricted key in live mode with permissions that match the test-mode key you tested.

Configure your production environment to use the restricted key

Use the new key in your production environment in the same way you configured the test key in your staging environment.

Retire the old secret key

When you’re confident everything works in test mode, rotate or expire your old secret key in the Dashboard. This ensures that no one can use it in the future. You can set a delayed expiration (up to 7 days) if you want a safety window during which you can still revert to the secret key.

Assign permissions to a restricted API key

You can configure restricted keys to fit your specific use cases in line with the principle of least privilege: a key should have the minimum permissions necessary to do its job, and no more. Here are several practical approaches to assign permissions.

Audit request logs to determine permissions

1. Go to the API Keys page in the Dashboard.
2. Find the restricted key you are configuring.
3. Click the overflow menu (⋯) next to the key.
4. Click View request logs to see all of the requests made with that key.

Review the API endpoints your application used during your testing with the restricted key to see exactly which resources your application used and whether you read or wrote to them:

• GET requests are reads
• POST and DELETE requests are writes

If your application worked properly in your testing, make a list of the successful calls in the request logs, then compare the list to the permissions you granted to the restricted key. You can remove any permissions your key did not use. To edit the key’s permissions:

1. Click the overflow menu (⋯).
2. Click Edit key.

If your application doesn’t work properly, you can filter the key’s request logs to show unsuccessful requests, then edit the key’s permissions in the keys menu to add the corresponding Stripe API permissions.

Review your code

You can build a list of required permissions by searching your codebase for Stripe SDK calls. Map each call to the corresponding permission in the Dashboard. For example:

• PaymentIntent.create(...) → PaymentIntents: Write
• Customer.retrieve(...) → Customers: Read
• Dispute.list(...) → Disputes: Read

Then configure your restricted key’s permissions to match only what you found.

Start with broad permissions, then remove what you don’t need

You can initially give a restricted key broad permissions, then remove any excess permissions after reviewing how the key is used.

In a sandbox, create a restricted key from the API keys menu. The available permissions are grouped into categories. If you know your Stripe API usage doesn’t include a particular category, like Stripe Billing, you can select None for that category. Otherwise, select Write for categories that are relevant to your Stripe API usage. Write permissions include Read permissions: if a key can write an API resource, it can also read that resource.

Test your application with the test-mode restricted key as described above so that your application uses the key to make Stripe API requests. Test every component of your application that uses Stripe APIs.

Use one restricted key per service or use case

If you have multiple services that use Stripe APIs (for example, a billing service, a reporting service, and a webhook handler), create a separate restricted key for each service, and give each key only the Stripe API permissions that each service needs. Granting separate permissions allows you to limit the potential impact of a key takeover if any one of your services is compromised.