Fix guides / Stripe: "Invalid API Key provided"

How to fix Stripe "Invalid API Key provided"

Checkout or a webhook handler fails with Invalid API Key provided: sk_live_****, or You did not provide an API key. Your Stripe code is fine. The key it reads is wrong or missing.

The usual causes

• The env var is missing in production. It works locally from .env, but it was never added to Vercel, Netlify, Replit Secrets, or Supabase Edge Function secrets. That gives "You did not provide an API key".
• Extra characters. Quotes, a trailing space, or a line break got pasted with the key.
• Wrong key type. The publishable key (pk_) was used on the server, where a secret (sk_) or restricted (rk_) key is required.
• A rolled or deleted key. The key was rotated in the dashboard and the old one is still deployed.
• Wrong account or sandbox. The key belongs to another Stripe account or sandbox than the prices you use.

Fix

1. In the Stripe Dashboard open Developers, API keys for the right account and mode, and copy the secret key again.
2. Paste it into your host's environment variables with no quotes, for example STRIPE_SECRET_KEY.
3. Redeploy (env changes only apply to new deployments). For Supabase Edge Functions run supabase secrets set STRIPE_SECRET_KEY=sk_....
4. Read it on the server only:

   const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!.trim());

Never put the secret key in the browser

If your key is in a VITE_ or NEXT_PUBLIC_ variable, it is visible to anyone. Roll it now in the dashboard and move Stripe calls into a server route or Edge Function.

Check the fix

1. Run a test checkout.
2. The request appears under Developers, Logs in the right mode.

Last updated 2026-10-21.