Title: Supporting Restricted API Keys?
Last modified: June 21, 2023

---

# Supporting Restricted API Keys?

 *  Resolved [clickingclients](https://wordpress.org/support/users/clickingclients/)
 * (@clickingclients)
 * [2 years, 11 months ago](https://wordpress.org/support/topic/supporting-restricted-api-keys/)
 * In light of the recent situation when Stripe API Keys were compromised…. resulting
   in over $70k in losses.
 * We are wondering if there is **full support **for Stripe Restricted API Keys 
   with your plugin.
 * We would still love to see **documentation for your plugin** on the **minimum
   permission requirements** for a **Restricted API Key** to work with Payment Plugins
   for Stripe WooCommerce.
 * We’ve done some test in test mode and, although successful we received an error
   in Stripe:
 * Only 1 error on stripe: 403 ERR GET /v1/account
 * invalid_request_error The provided key ‘rk_test_*********************************************************************************************
   L’ does not have the required permissions for this endpoint on account ‘acct_1*************
   3’. Having the ‘rak_accounts_kyc_id_numbers_read’ permission would allow this
   request to continue.
    -  This topic was modified 2 years, 11 months ago by [clickingclients](https://wordpress.org/support/users/clickingclients/).

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Thread Starter [clickingclients](https://wordpress.org/support/users/clickingclients/)
 * (@clickingclients)
 * [2 years, 11 months ago](https://wordpress.org/support/topic/supporting-restricted-api-keys/#post-16835516)
 * **Can you please assist in how we overcome the error?**
   We used the following
   restricted key settings:
    - All core resources: Write
    - Checkout Sessions: only set to Write if you plan to use the Stripe Checkout
      feature; otherwise set to None.
    - Webhook Endpoints: Read
    - Radar: Write
    - Everything else (including Stripe Connect) set to “None”
 *  Plugin Author [Clayton R](https://wordpress.org/support/users/mrclayton/)
 * (@mrclayton)
 * [2 years, 11 months ago](https://wordpress.org/support/topic/supporting-restricted-api-keys/#post-16835624)
 * Hi [@clickingclients](https://wordpress.org/support/users/clickingclients/)
 * > In light of the recent situation when Stripe API Keys were compromised…. resulting
   > in over $70k in losses.
 * Are you referring to this podcast where the person was using the WooCommerce 
   Stripe Gateway plugin? To be clear, that is not our plugin. [https://webdesigneracademy.com/my-stripe-account-was-hacked-and-stripe-said-i-have-to-repay-70k/](https://webdesigneracademy.com/my-stripe-account-was-hacked-and-stripe-said-i-have-to-repay-70k/)
 * When using live mode, Stripe requires that the merchant use Standard Connect.
   Stripe requires us to integrate that way and you will notice there isn’t an option
   to manually enter your API keys for live mode. The secret key generated during
   the connect process is not visible in your stripe.com dashboard. That limits 
   the attack vectors that a potential hacker would have trying to access that key.
 * Keys generated via Connect can be rejected by removing the authorization.
 * Regarding the concept of restricting a secret key generated by Standard Connect,
   we have submitted a request to the Stripe engineers as we’ve never come across
   that question before. We need Stripe to comment on what’s possible on their end.
 * We’ll update this thread once Stripe gets back to us.
 * Kind Regards
 *  Plugin Author [Clayton R](https://wordpress.org/support/users/mrclayton/)
 * (@mrclayton)
 * [2 years, 11 months ago](https://wordpress.org/support/topic/supporting-restricted-api-keys/#post-16835680)
 * [@clickingclients](https://wordpress.org/support/users/clickingclients/) after
   reading through the podcast transcripts, here is what I believe the hacker did,
   and why that same exploit is not possible using our plugin.
    1. The hacker compromised the merchant’s secret API key, either through the Stripe
       dashboard, where the secret key can be viewed, or by hacking the merchant’s 
       eCommerce site.
    2. Once the hacker was in possession of the secret key, they made an API request
       to the `https://api.stripe.com/v1/accounts` endpoint and setup a connected account.
    3. Once that fake connected account was created, the hacker initiated an instant
       payout to their connect account.
 * The reason that exploit would not be possible using our plugin is because we 
   rely on a secret key that is generated via the Standard Connect process. That
   secret key is already restricted in what API endpoints it can reach. For example,
   if you tried to create a connected account using the secret key via endpoint `
   https://api.stripe.com/v1/accounts` you would receive the following error:
 *     ```wp-block-code
       {
           "error": {
               "message": "Connect platforms cannot create new accounts on behalf of their connected accounts.",
               "type": "invalid_request_error"
           }
       }
       ```
   
 * That means, if a hacker was able to compromise your secret by hacking into your
   WordPress site, they wouldn’t be able to transfer money out of your account.
 * Kind Regards

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Supporting Restricted API Keys?’ is closed to new replies.

 * ![](https://ps.w.org/woo-stripe-payment/assets/icon-256x256.png?rev=2611337)
 * [Payment Plugins for Stripe WooCommerce](https://wordpress.org/plugins/woo-stripe-payment/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/woo-stripe-payment/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/woo-stripe-payment/)
 * [Active Topics](https://wordpress.org/support/plugin/woo-stripe-payment/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/woo-stripe-payment/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/woo-stripe-payment/reviews/)

 * 3 replies
 * 2 participants
 * Last reply from: [Clayton R](https://wordpress.org/support/users/mrclayton/)
 * Last activity: [2 years, 11 months ago](https://wordpress.org/support/topic/supporting-restricted-api-keys/#post-16835680)
 * Status: resolved