--- title: "Stripe secret key is in my frontend code" description: "An sk_ key in browser code, a NEXT_PUBLIC_ variable, or a committed .env gives anyone full Stripe access. How to rotate it now and move calls to a server." url: https://whocanfixmyapp.com/problems/stripe-secret-key-in-the-frontend --- [Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Payments](https://whocanfixmyapp.com/problems#payments) # Stripe secret key is in my frontend code VC-36 · Stripe · Lovable · v0 · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley) Quick verdict Get an engineer for this one. Rotate the key now, then move Stripe calls to a server. - **How serious**: Critical - **Fix it yourself?**: No, get an engineer - **Typical cost**: €99–$990 for a single fix, or $1,500–$15,000 if payments need rebuilding ([prices](https://whocanfixmyapp.com/pricing)) - **Top rated for Lovable**: [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 **What you see.** A key starting with sk_live_ or sk_test_ appears in your app's browser code, your GitHub repo, or a NEXT_PUBLIC_ variable. ## Why it happens Stripe has two kinds of keys. The publishable key, `pk_`, is safe in a web page because it can only create tokens from card details. The secret key, `sk_`, has unrestricted permissions on all Stripe APIs. Anyone who holds it can issue refunds, read customer data, and move money. Stripe says it must stay in your server environment and never in source code or shipped applications. AI builders expose it in three ways. The agent puts the Stripe call in a browser component. In v0 and other Next.js apps it names the variable `NEXT_PUBLIC_STRIPE_SECRET_KEY`, and Next.js inlines every `NEXT_PUBLIC_` value into the JavaScript sent to the browser. Or the key sits in a committed `.env` file in the GitHub repo that Lovable syncs. Stripe scans for exposed keys and may deactivate one it finds, but it does not guarantee detection. Treat any exposure as a compromise, even if nothing looks wrong yet. ## Fix it yourself 1. In the Stripe dashboard, open **Developers → API keys**, open the key's menu, choose **Rotate key**, and set the expiration to **Now**. Copy the new key once. 2. Put the new key only in your host's environment settings. In Lovable, use the **Secrets** area under **More**. In Vercel, add it without the `NEXT_PUBLIC_` prefix. 3. Search the whole repository, including `.env` files and Git history, for `sk_live` and `sk_test`. Remove every match and make sure `.env*` is in `.gitignore`. 4. Ask the agent to move every Stripe call that uses the secret key into a server route, server action, or edge function, and to send the browser only the publishable key. 5. Check **Developers → Logs** for requests you do not recognize, and review refunds and payouts for the exposure period. 6. Create a restricted key with only the permissions the app needs and use it in place of the full secret key. ## When to get an engineer Rotate the key yourself first, that part cannot wait. Then hire if Stripe calls live in several browser files or if you saw unknown requests in the logs. Tell the engineer when the key was exposed, which files held it, and your host. Moving payments to the server is a single fix at €99–$990 in 1–3 days. If the whole payment flow was built in the browser, expect a payments rebuild inside a cleanup at $1,500–$15,000. ## Top-rated companies for Lovable apps Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score). - 1 · [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 · Best for: A check before launch · Free first step · from $49 - 2 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490 - 3 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299 [All 59 Lovable companies, ranked](https://whocanfixmyapp.com/best/lovable-developers) ## Check these DATA-02 · Critical No secret keys reach the browser Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected. OPS-04 · Medium Secrets live in the host's environment settings Keys belong in environment variables on the server, not in the repository or in front-end code. PAY-01 · Critical Paid accounts are unlocked by a verified payment webhook Access should change only when your server receives a signed webhook from Stripe or your provider, not when the browser reaches a success page. PAY-02 · High Prices and plans come from the server If the price or plan ID is sent from the browser, someone can edit it. The server should look it up. CODE-01 · High The code lives in a Git repository you own Connect GitHub or export the project. If the builder account is lost, the product should not be. ## Questions ### The key is sk_test_, does it still matter? Less money is at risk, but it still gives full access to your sandbox and signals that the live key will follow the same path. Rotate it and fix the code before you switch to live keys. ### Is the pk_live_ key also a problem? No. Stripe designs publishable keys to be included in front-end code. It cannot create charges or read account data. Only sk_ and rk_ keys must stay on the server. Sources: [Stripe: API keys](https://docs.stripe.com/keys); [Stripe: Best practices for managing secret API keys](https://docs.stripe.com/keys-best-practices.md); [Next.js: Environment variables guide](https://nextjs.org/docs/app/guides/environment-variables); [Lovable: Built-in backend overview](https://docs.lovable.dev/features/cloud). **Lovable guide** What Lovable builds, where it breaks and how to check it: [Lovable app rescue: what breaks and how to check it](https://whocanfixmyapp.com/guides/lovable). **Same category** - [Bolt app broke after I added payments: Stripe, webhooks and what to check](https://whocanfixmyapp.com/problems/bolt-app-broke-after-adding-payments) - [Customer paid but their account was not upgraded](https://whocanfixmyapp.com/problems/stripe-webhook-not-firing-paid-but-not-upgraded) - [Stripe is still in test mode on the live site](https://whocanfixmyapp.com/problems/stripe-still-in-test-mode-on-the-live-site) - [Stripe checkout opens and then errors](https://whocanfixmyapp.com/problems/stripe-checkout-opens-then-errors) - [Cancelled subscriptions still have access](https://whocanfixmyapp.com/problems/cancelled-subscriptions-still-have-access) [All payments problems](https://whocanfixmyapp.com/problems#payments) **Run every check** The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.