What security rule is associated with the secret key?

What security rule is associated with the secret key?

• A. Never share your Publishable Key pk_.
• B. Never share your API keys with customers.
• C. Never share your secret key!
• D. Never store your secret key in your public repository.

Answer: (C)

The key thing being tested is that secret keys are highly sensitive credentials and must never be exposed. In Stripe, the secret key provides full access to your account, allowing actions like creating charges, managing customers, refunds, and other privileged operations. Because of this level of access, the rule is clear and absolute: never share your secret key. It should stay on your server and be protected, typically stored as an environment variable or in a secure vault, not sent to the client or embedded in front-end code or public repositories. If a secret key ever leaks, rotate it immediately and update your integrations. Use the publishable key—which is safe to expose on the client side—for any code that runs in the browser, and apply good practices like not logging the secret key, not including it in version control, and limiting access through proper server-side controls. The main takeaway is that secret keys must remain confidential to prevent unauthorized access to your Stripe account.

The key thing being tested is that secret keys are highly sensitive credentials and must never be exposed. In Stripe, the secret key provides full access to your account, allowing actions like creating charges, managing customers, refunds, and other privileged operations. Because of this level of access, the rule is clear and absolute: never share your secret key. It should stay on your server and be protected, typically stored as an environment variable or in a secure vault, not sent to the client or embedded in front-end code or public repositories. If a secret key ever leaks, rotate it immediately and update your integrations. Use the publishable key—which is safe to expose on the client side—for any code that runs in the browser, and apply good practices like not logging the secret key, not including it in version control, and limiting access through proper server-side controls. The main takeaway is that secret keys must remain confidential to prevent unauthorized access to your Stripe account.