Stripe

What the agent does

keykeeper providers show stripe
keykeeper save --provider stripe --from-clipboard --create --purpose "what this task does"
keykeeper run -c stripe -- <your command>

--provider stripe fills in the credential id and the field. The environment variable is the one Stripe's own tools read, so nothing has to be mapped.

What only you can do

What to choose

Always a Restricted key (rk_…), never the Secret key (sk_…): set each resource to None except the ones the task needs (Read where Read is enough). Start in sandbox (rk_test_) and only create a live key when the task really goes live. Balance: Read lets KeyKeeper verify it.

What KeyKeeper checks

• Before writing: the value must look like a Stripe key (starts with rk_live_ or rk_test_ or sk_live_ or sk_test_, shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
• After saving: KeyKeeper itself sends GET https://api.stripe.com/v1/balance with the key in the Authorization header (reads the account balance (Balance: Read)). The agent receives accepted, rejected or could not reach — never the value.

Rotation and expiry

No automatic expiry. Rotation can give the old value a grace period; some payment and transfer capabilities can be limited after long inactivity. Rotate or revoke at dashboard.stripe.com.