Three read permissions
The key needs read access to Accounts, Balance, and Balance Transaction Sources — nothing else.
Connect Stripe with a read-only restricted key.
VerifiedMRR never asks for your secret Stripe key. You create a restricted key (rk_…) with three read-only permissions, paste it once, and we validate then encrypt it. Here is the exact flow — about two minutes.
What this key can and can't do.
Cannot touch money
A restricted key with read scopes cannot charge, refund, or change settings, even if it were exposed.
Revoke anytime
Roll or delete the key in your Stripe dashboard whenever you want; disconnecting in VerifiedMRR deletes our copy.
Step 1 — Open Stripe's API keys page
In your Stripe Dashboard, go to Developers → API keys, then choose Create restricted key. A restricted key starts with rk_ and lets you grant only specific read permissions — unlike your secret key (sk_…), which can do everything.
Step 2 — Grant exactly three read permissions
Name the key something like 'VerifiedMRR (read-only)'. Then set these three permissions to Read, and leave everything else as None:
Connect › Accounts — Read. This lets VerifiedMRR confirm which account it is reading.
Balance — Read. Balance Transaction Sources — Read. Together these are what it uses to reconcile your revenue.
That is the complete list. With only these read scopes, the key cannot move money, refund, or change any setting.
Step 3 — Copy the key and paste it into VerifiedMRR
Create the key and copy the rk_… value — Stripe shows it once. In VerifiedMRR, choose Connect Stripe and paste it. We validate it by reading a single balance transaction, confirm the permissions, then encrypt the key with AES-GCM before storing it.
The in-app onboarding shows a live, copyable checklist of these same steps, so you can follow along there too.
Step 4 — You're connected
That is it. VerifiedMRR syncs your balance transactions daily and shows net revenue, refunds, fees, and trend — and never has the ability to touch your money. If you run more than one Stripe account, repeat with a restricted key per account; each stays in its own currency.
Disconnecting or revoking later
Disconnect the account in VerifiedMRR and the stored key is deleted. You can also roll or revoke the restricted key from Stripe's dashboard at any time, which cuts off access immediately regardless of anything on our side.
Keep exploring
Keep exploring
FAQ
Before you connect a provider.
Why not just use my secret key?
A secret key (sk_…) can do everything, including move money. A restricted key (rk_…) grants only the read permissions you choose, so VerifiedMRR gets exactly what it needs and nothing more.
Which permissions exactly?
Read access to three scopes: Connect › Accounts, Balance, and Balance Transaction Sources. Everything else stays None.
Can this key charge my customers or issue refunds?
No. With read-only scopes it physically cannot charge, refund, or change settings, even if the key were exposed.
What if I have multiple Stripe accounts?
Create one restricted key per account and connect each. VerifiedMRR shows them side by side and keeps each in its own currency.
How do I revoke access?
Disconnect in VerifiedMRR to delete the stored key, or roll/delete the restricted key in your Stripe dashboard to cut access immediately.
Ready to connect Stripe?
Create a restricted key with three read permissions, paste it once, and see your revenue reconciled — read-only.