How to rotate your Stripe API key

Updated October 2026

Stripe rotates a secret key through the Dashboard only, with a 7-day window where both the old and new key work. There is no API call that does this for you. The webhook signing secret is different, and that half can be automated.

Here's the exact Dashboard process, from Stripe's own docs.

The manual steps for the secret key

1. On the API keys page, click the overflow menu (⋯) for the key you want to rotate.
2. Select Rotate key.
3. Pick an expiration from the Expiration dropdown. Choosing Now deletes the old key right away. Choosing a time in the future lets both keys work until that time passes.
4. Click Rotate API key, then copy the new value immediately. You can't retrieve it again later.
5. Add a note saying where you saved it, then save.

Stripe's own guidance on doing this safely, checked October 24, 2026: "both the old and new keys work for up to 7 days," which it calls the grace period. Stripe also recommends rolling the new key out to a small subset of servers first, watching the logs, and only expiring the old key once its request volume has sat at zero for a few hours or days.

What breaks if you miss a place

Any server, function, or script still holding the old key keeps working during the grace period, then fails the moment it expires. If you expire the old key before every server has switched over, those calls start failing immediately, with no warning beyond whatever you set as the expiration time.

How to check the old key is actually dead

Open the request logs for that key (overflow menu, View request logs) before you expire it. Stripe's own advice is to wait until that key's request volume has been at zero for a few hours or days before killing it, rather than guessing.

The webhook signing secret is a separate thing

Stripe's docs are direct about this: "Webhook signing secrets aren't API keys, they're per-webhook secrets that your webhook receiver uses to authenticate that webhooks actually came from Stripe." You find and manage them under the Webhooks section, not the API keys page. Rolling a signing secret with overlap is also a Dashboard action today, with no public rotate endpoint for it either, per Stripe's own docs, checked October 24, 2026.

We tested this ourselves. On October 24, 2026, we rotated a Stripe webhook signing secret in Stripe test mode: a new endpoint and secret, both working during the switch, then the old endpoint deleted.

Or let Key Robot do it, for the part it can

Stripe gives no API for creating a new secret key. That part stays a Dashboard click only a person can make. Stripe's own docs confirm there's no way around it. The webhook signing secret is different. It can be created and swapped by API, so Key Robot's support for automating that half is coming.

Once you roll the secret key yourself in the Dashboard, Key Robot can take it from there, pushing the new value everywhere your app needs it and confirming nothing broke, the same way it already does for Neon and Resend keys today.

See how to rotate your OpenAI key for a service with a similar one-person-must-click step, or the rotate hub for what's live versus coming next.