RestrictedApiKey

Source: src/Stripe/RestrictedApiKey.ts

A least-privilege Stripe API key for a Function/Worker host.

HTTP bindings call token.bind(capability, { permissions }) the same way Cloudflare HTTP bindings attach policies to an AccountApiToken. Stripe restricted keys (rk_…) can only be created in the Dashboard today — POST /v2/iam/api_keys is Stripe Apps private preview. Until that API is generally available, this resource stores the collected permissions and injects either a user-supplied RAK or the account secret key.

Creating a token

Host token, permissions from bindings

const token = yield* Stripe.RestrictedApiKey("ApiToken");
yield* token.bind`RetrieveProduct`({
  permissions: ["products_read"],
});

Dashboard-created restricted key

const token = yield* Stripe.RestrictedApiKey("ApiToken", {
  value: process.env.STRIPE_RESTRICTED_KEY,
  permissions: ["customers_read"],
});