In 2024, Stripe announced new secure authentication requirements. If you previously configured our Stripe, Stripe ACH, or Stripe SEPA payment gateway modules using a secret key, you must update your configuration.

How can I identify secret and restricted API keys? #

If you are unsure whether you need to update your key, go to to Configuration () > System Settings > Payment Gateways and review your configuration.

Restricted API keys begin with rk_ while old secret keys begin with sk_:

• If Stripe Secret API Key begins with sk_, you are still using a secret key and must replace it using the steps below.
• If Stripe Secret API Key begins with rk_, your configuration uses a restricted API key and does not require additional updates.

Add a Restricted API Key to a Stripe Module #

To add restricted API keys to your Stripe, Stripe ACH, or Stripe SEPA configuration:

1. Go to your Stripe module’s configuration. #

Go to Configuration () > System Settings > Payment Gateways.

Find the desired payment gateway in the list (Stripe, Stripe ACH, or Stripe SEPA) and click on it.

2. Retrieve the restricted API key from Stripe. #

To do this:

1. Go to the WHMCS app listing in the Stripe App Marketplace.
   
2. Click Install app.
3. For Install in in the bottom-right corner, choose live mode (for production use) or test mode (for testing Stripe).
   
4. Click Install app.
5. When a success message appears, click Continue to app settings.
   
6. In the API key information that appears, copy the displayed Restricted key value. You will use it in the next step.
   

3. Paste the new key into your Stripe configuration. #

In WHMCS, paste the copied restricted key into Stripe Secret API Key.

4. Save the updated configuration. #

To save the updated configuration, click Save Changes.

Last modified: 2025 February 12