Stripe secret_key_required: a publishable key called a secret API

What it means in plain English

The browser, or a server route, called a Stripe API that is not allowed to use a publishable key. Stripe's error list defines secret_key_required as: the API key provided is a publishable key, but a secret key is required. Stripe says to take the current keys from the Dashboard and update the integration.

A publishable key (pk_) is the one that belongs in the browser. Creating a Checkout Session, a PaymentIntent, a refund, or a Billing Portal session needs the secret key.

Likely causes

• The client calls api.stripe.com with pk_live_ or pk_test_ in the Authorization header.
• The server route loaded NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY or VITE_STRIPE_PUBLISHABLE_KEY and passed it to the Stripe SDK.
• The secret key was never set on the host, so the code fell back to the publishable key.

How to fix it, step by step

1. Move the Stripe call to a server route. Stripe's key guide says only publishable keys are safe to expose, and that other keys should not go in application code that ships to the browser.
2. Read the secret from an environment variable that is not prefixed with NEXT_PUBLIC_ or VITE_. Use sk_test_ in test mode and sk_live_ in live mode, matching the price and the publishable key.
3. Leave the publishable key in the browser for Stripe.js. Do not send it as the API key for a secret endpoint.
4. Redeploy the server after changing the variable.

How to check it worked

• The Stripe error secret_key_required is gone.
• The browser still only has a pk_ key, and the server log shows the secret call succeeding.

A key that is present, but from the other Stripe mode, is a different error. See No such price: test mode vs live mode.

Sources

• https://docs.stripe.com/error-codes (opens in a new tab)
• https://docs.stripe.com/keys (opens in a new tab)