Send your first Stripe API request
Get started with the Stripe API.
Every call to a Stripe API must include an API secret key. After you create a Stripe account, we generate two pairs of API keys for you—a publishable client-side key and a secret server-side key—for both testing in a sandbox and in live modes. To start moving real money with your live-mode keys, you must set up your Stripe account.
Before you begin
This guide walks you through a simple interaction with the Stripe API—creating a customer. For a better understanding of Stripe API objects and how they fit together, take a tour of the API or visit the API reference. If you’re ready to start accepting payments, see our quickstart.
Send your first API request
You can begin exploring Stripe APIs using the Stripe Shell. The Stripe Shell allows you to execute Stripe CLI commands directly within the Stripe docs site. As it operates in a sandbox environment only, you don’t have to worry about initiating any real money-moving transactions.
To create a customer using the Stripe Shell, enter the following command:
Command Linestripe customers create --email=jane.smith@email.com --name="Jane Smith" --description="My First Stripe Customer"If everything worked, the command line displays the following response:
{ "id":, "object":"cus_LfctGLAICpokzr","customer"(Optional) Run the same command by passing in your API secret key in a sandbox:
Command Linestripe customers create --email=jane.smith@email.com --name="Jane Smith" --description="My First Stripe Customer" --api-key sk_test_BQokikJOvBiI2HlWgH4olfQ2If everything worked, the command line displays the following response:
{ "id":, "object":"cus_LfdZgLFhah76qf","customer"
View logs and events
Whenever you make a call to Stripe APIs, Stripe creates and stores API and Events objects for your Stripe user account. The API key you specify for the request determines whether the objects are stored in a sandbox environment or in live mode. For example, the last request used your API secret key, so Stripe stored the objects in a sandbox.
Store your API keys
When you sign up for a Stripe account, we create three types of API keys for you:
| Type | Safe to expose | Description |
|---|---|---|
Publishable API key pk_ | Yes | API key for Stripe.js, Elements, and mobile SDKs. It can identify your account and create tokens or PaymentMethods from payment details, but it can’t perform sensitive operations such as creating charges or reading account data. You can include it in front-end code or applications you distribute. |
Restricted API key (RAK) rk_ | No | API key with permissions you control. Limit the damage to your business that a fraudulent actor could cause if they obtained your key. Create as many RAKs as you want and assign them to different parts of your application. Stripe Apps can also use RAK authentication to generate a permissioned key when a user installs an app. This guide explains how to configure and use RAKs. |
Secret API key sk_ | No | API key that has unrestricted permissions on all Stripe APIs. Because you can’t limit their permissions, we don’t recommend using secret keys for new use cases, and for existing integrations, we recommend migrating secret key usage to RAKs. |
Organization API key sk_ | No | API key that works at the organization level. Same as account-level restricted or secret keys, but operates at the organization level to manage multiple Stripe accounts at once. This guide explains how to configure and use organization API keys. |
We also support managed API keys issued by certain hosting platforms. Managed keys are secret API keys that a hosting platform delivers directly to your hosted applications. You don’t need to handle managed keys directly; your hosting provider issues and rotates them for you.
Webhook signing secrets
Webhook signing secrets aren’t API keys—they’re per-webhook secrets that your webhook receiver uses to authenticate that webhooks actually came from Stripe. You can find the signing secret for each webhook endpoint in the Webhooks section of the Dashboard.
You’re responsible for managing your API keys safely. Read our guide to best practices for protecting API keys.