> ## Documentation Index
> Fetch the complete documentation index at: https://onecli.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Use a Restricted Stripe Key With AI Agents

> Let agents look up Stripe customers and payments, and issue refunds or invoices, with a restricted API key the gateway injects and agents never see.

## Overview

OneCLI connects AI agents to [Stripe](https://stripe.com) with a restricted API key. Agents can look up customers, payments, and subscriptions, and take actions like refunds or invoices. The gateway injects the key into every request, so your agent never sees it.

Connecting takes about a minute.

## What you will set up

* A Stripe restricted key (`rk_`) with only the permissions agents need
* Automatic key injection on Stripe API requests
* Per-agent, per-tool access, such as approval before refunds

## Connect Stripe

**1. Create a restricted key in Stripe**

In the Stripe Dashboard, open [Developers > API keys](https://dashboard.stripe.com/apikeys) and click **Create restricted key**. Name it `OneCLI` and grant only the permissions your agents need. Start with **Read** and add **Write** only where agents must act.

Copy the key right away. Restricted keys start with `rk_`.

**2. Paste it in OneCLI**

In the OneCLI dashboard, open **Connections** > **Stripe**, paste the key into **Restricted API key**, and click **Connect Stripe**. Add a **Label** like `production` or `sandbox` to tell several Stripe accounts apart.

![OneCLI connect window for Stripe, showing the setup guide link, the Restricted API key field, and the Connect Stripe button.](https://mintcdn.com/chartdbinc/yFw2bbdvTPdZgMOT/images/integrations/stripe/onecli-connect-stripe.png?fit=max\&auto=format\&n=yFw2bbdvTPdZgMOT\&q=85\&s=6dee084479c6609f0d42868cddf97b25)

The Stripe connect window in OneCLI.

OneCLI checks the key when you connect. It rejects publishable keys (`pk_`), which can't read account data.

> [!NOTE]
>
> Stripe recommends restricted keys (`rk_`) over secret keys (`sk_`) for AI agents. The key's own permissions are the hard limit on what any agent can do.

## What agents can do

| Area | What agents can do |
| - | - |
| **Account** | Read the account, balance, and balance transactions |
| **Customers** | List, read, create, update, and delete customers |
| **Payments** | List charges and payment intents, create or cancel payment intents, create charges and refunds |
| **Billing** | List, create, update, and cancel subscriptions. Create and finalize invoices |
| **Catalog** | List and create products and prices |
| **Operations** | List disputes, payouts, and events. Create payouts |

## Controlling access

[Grant](https://onecli.sh/docs/guides/agent-access.md) the connection to each agent that needs it, and choose per tool what runs freely, what needs approval, and what's blocked. Anything that moves money (**Create refund**, **Create charge**, **Create payout**, **Cancel subscription**) belongs behind approval. Organization [rules](https://onecli.sh/docs/guides/rules.md) add guardrails on top. A blocked request never reaches Stripe.

To disconnect, remove the connection in **Connections** > **Stripe**, then roll or delete the key in Stripe under **Developers** > **API keys**.

## FAQ

> [accordion] How do I rotate my Stripe key?
>
> Roll the restricted key in Stripe, then paste the new key into **Connections** > **Stripe**. Agents pick it up automatically.

> [accordion] How do I keep the Stripe key out of the agent's context?
>
> Don't set `STRIPE_API_KEY` in the agent's environment. Store the key in OneCLI, and the gateway injects it at the proxy. See [How it works](https://onecli.sh/docs/how-it-works.md).

> [accordion] Should I use a secret key or a restricted key?
>
> A restricted key (`rk_`). Stripe recommends restricted keys for AI agents, and the key's permissions are the hard limit on what any agent can do.

> [accordion] Can I require approval before refunds or payouts?
>
> Yes. Put those tools behind approval when you [grant](https://onecli.sh/docs/guides/agent-access.md) the connection.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.