What happens to your key. Exactly.
Verification asks for a Stripe restricted key, read-only, on two resources. This page lists every request it makes, what is kept, and how to take the key back.
The key
- Restricted, never secret. A key starting with sk_ (full access) is refused before anything is sent to Stripe. Only rk_live_ keys are accepted.
- Two read permissions: Subscriptions: Read and Prices: Read. Everything else stays “None”. With those, the key cannot charge, refund, see cards, see customers' details beyond their subscriptions, or change anything.
- Sent once, over HTTPS, in the body of a form post — never in a URL, so it does not reach access logs.
Every request made with it
GET https://api.stripe.com/v1/subscriptions?status=active&limit=100&expand[]=data.items.data.price
Repeated with starting_after until the last page (at most 50 pages). That is the only endpoint called. MRR is the sum of each active item's price × quantity, normalized to a month, before discounts.
What is kept
- Kept: the MRR figure, the number of active subscriptions, the currency, the date, and the product it belongs to.
- Never kept: the key itself, customer names, e-mails, amounts per customer, or any Stripe object. The key lives in memory for the duration of that one request and is dropped; it is not written to the database, to a file or to logs.
Take it back right after
You do not need to keep the key alive. As soon as the verification page shows your figure, open Stripe → Developers → API keys and delete the restricted key. Nothing on MRRLens depends on it afterwards. To refresh the figure later, create a new key and verify again.
What gets published
Your MRR appears on your product page as Verified by MRRLens only after the badge is found on your homepage, so nobody can verify a product they do not run. If your product carried an estimate, that estimate is published next to the verified figure on the methodology page.
Coming
Stripe Connect (an OAuth button with read-only scope, no key to copy) is planned once enough founders use verification to justify a platform review. Until then the restricted key is the narrowest access Stripe offers.