Add Restricted API Keys to Stripe

  • You must replace the secret key in your Stripe configurations with a restricted API key.
  • In WHMCS 8.11 GA and later, warnings will appear if you have not updated your configuration.

In January 2024, Stripe announced that it will require merchants to begin using new secure authentication methods beginning on October 29, 2024. If you previously configured our Stripe, Stripe ACH, or Stripe SEPA payment gateway modules using a secret key, you must update your configuration.

For more information, see Restricted API Key Requirement.

How can I identify secret and restricted API keys?

If you are unsure whether you need to update your key, go to to Configuration () > System Settings > Payment Gateways and review your configuration.

Restricted API keys begin with rk_ while old secret keys begin with sk_:

  • If Stripe Secret API Key begins with sk_, you are still using a secret key and must replace it using the steps below.
  • If Stripe Secret API Key begins with rk_, your configuration uses a restricted API key and does not require additional updates.

Add a Restricted API Key to a Stripe Module

To add restricted API keys to your Stripe, Stripe ACH, or Stripe SEPA configuration:

1. Go to your Stripe module’s configuration.

Go to Configuration () > System Settings > Payment Gateways.

Stripe in the list of payment gateways.

Find the desired payment gateway in the list (Stripe, Stripe ACH, or Stripe SEPA) and click on it.

2. Retrieve the restricted API key from Stripe.

To do this:

  1. Go to the WHMCS app listing in the Stripe App Marketplace.
    The WHMCS app in the Stripe App Marketplace.
  2. Click Install app.
  3. For Install in in the bottom-right corner, choose live mode (for production use) or test mode (for testing Stripe).
    Installing the WHMCS app in the Stripe App Marketplace.
  4. Click Install app.
  5. When a success message appears, click Continue to app settings.
    Successful installation of the WHMCS app in the Stripe App Marketplace.
  6. In the API key information that appears, copy the displayed Restricted key value. You will use it in the next step.
    Generated API keys in the WHMCS app in the Stripe App Marketplace.

3. Paste the new key into your Stripe configuration.

In WHMCS, paste the copied restricted key into Stripe Secret API Key.

Publishable and restricted keys in a Stripe configuration.

4. Save the updated configuration.

To save the updated configuration, click Save Changes.

If you use multiple Stripe payment gateway modules, you may need to repeat these steps for each configured Stripe module.

Last modified: November 19, 2024