Replace a Stripe key if it leaked, if someone who knew it left, or if you lost it. This article gives the order that keeps payments working.

You need access to the Stripe Dashboard and to Settings → VisionScaper in WordPress.

1. In Stripe, open the API keys page.
2. Click the overflow menu (three dots) next to the key and choose Rotate key.
3. Pick an expiry in the Expiration list. Stripe’s page says both old and new keys work for up to 7 days when you use its grace period. Choosing Now deletes the old key at once.
4. Click Rotate API key.
5. Click the new key value to copy it, then save it. Stripe will not show it again.
6. In WordPress, paste it into Stripe secret key and save.
7. Wait until the old key shows no requests, then expire it.

1. In the Webhooks tab, click the destination.
2. Open its overflow menu and choose Roll secret.
3. You can expire the current secret now or delay up to 24 hours. Delay it while you update VisionScaper.
4. Copy the new whsec_ value into Stripe webhook signing secret and save.

1. Rotate it with Now as the expiry.
2. Check the key’s request log (overflow menu, View request logs).
3. Contact Stripe support if you see requests you do not recognize.

• Add a note to each key that says where it lives.
• Stripe offers access policies that limit a key to certain IP addresses. Whether your host has a fixed IP is up to your host.

• Payments stop right after rotating. You chose Now and VisionScaper still has the old key. Paste the new one.
• Stripe says the key has limited access. Stripe can limit a key not used for payouts or transfers in 180 days. Use Restore access in the overflow menu.

• Stripe, API keys (rotate, expire, restore): https://docs.stripe.com/keys (read 2026-10-15)
• Stripe, webhooks (roll secret): https://docs.stripe.com/webhooks

• Get your Stripe secret key
• Get your Stripe webhook signing secret
• Stripe test mode and live mode