Stripe Account Access, API Keys and Permissions Review (Defensive)
Check who and what can access the payment account.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Review access to our Stripe account as a defensive review of my own account, recommending least privilege and rotation of anything that may have been exposed, handled by the owner. Team members and roles: [TEAM_ROLES]. API keys in use, where they are stored (location types only, never the keys), and who knows them: [KEY_USAGE]. Webhook endpoints and where their signing secrets are stored: [WEBHOOKS]. Connected apps: [CONNECTED_APPS]. Sign-in protections: [SIGN_IN_PROTECTIONS]. Never ask me to paste keys, secrets or card data. List what you can and cannot judge from the descriptions and ask me to confirm the rest. Check for users with more rights than needed, shared logins, missing two-factor authentication, leavers, secret keys in code repositories or chat, restricted keys not used when possible, unused keys, webhook secrets in plain text, and apps with broad access. Prioritise by what an attacker could do with the access, in plain words (a secret key in a public repository could allow refunds or data access), and by how fast the fix is. Inventory table of keys and tokens (by name and purpose only): Environment, Type (publishable, secret, restricted), Where stored, Owner, Last rotated, Needed; any key stored outside the secrets store is moved. Rotation procedure: create the new key, update the application, deploy, verify, then revoke the old key. If a key may have been exposed: revoke or roll it from the dashboard, deploy the new key, review recent activity, and tell the account owner [VERIFY]. Recommend restricted keys with minimal permissions, a secrets manager, two-factor authentication for all users, a quarterly review of roles, and a yearly drill rotating a test key and recording the time. Mark role and key names [VERIFY].
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.