Stripe Error: api_key_invalid — Invalid API Key Provided

import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);

try {
  await stripe.customers.list({ limit: 1 });
} catch (err) {
  // err.type === 'StripeAuthenticationError'
  // err.code === undefined (auth errors don't have a `code` field)
  // err.statusCode === 401
  // err.message === 'Invalid API Key provided: sk_test_***...***'
}

api_key_invalid is Stripe’s authentication-layer rejection. Before your request reaches any business logic, Stripe checks the bearer token against its key registry; if it doesn’t find a live record, the response is HTTP 401 and your SDK throws StripeAuthenticationError. The error has nothing to do with payments, customers, or your account — it’s purely about whether the credentials you presented are valid.

The fix is almost always boring: a test key in production, an env var that didn’t load, or a rolled key whose replacement never reached the deploy. Add a startup assertion that prints the key prefix and length, and you’ll catch 95% of these before they reach a customer. The other 5% are rotations and revocations that Dashboard → Developers → API keys reveals in seconds.

Why this happens

• Test key used in live mode (or vice versa). Stripe has two parallel environments. `sk_test_*` keys only access test data; `sk_live_*` keys only access live data. Pointing a test key at live API endpoints (or live key at the test dashboard's data) returns `Invalid API Key`. The keys themselves are valid — they're just for the wrong mode.
• Environment variable is undefined or empty. If `process.env.STRIPE_SECRET_KEY` is undefined, the SDK sends the literal string `undefined` (or `null`/empty) as the bearer token. Common in Vercel/Netlify when the env var was added but the deployment wasn't rebuilt, or in Docker when `--env-file` wasn't passed.
• Key was rolled or deleted in the Dashboard. If a teammate rolled the key after a leak, your old copy stops working immediately. Stripe may also retire restricted keys with overly broad scopes during their security audits. Dashboard → Developers → API keys shows last-used timestamp and revocation history.
• Whitespace, newline, or quote characters in the key. Copy-pasting from a Slack message, terminal, or env file can introduce trailing whitespace or smart quotes. The key looks right but has invisible bytes the API rejects. `.env` files quoted with `STRIPE_SECRET_KEY="sk_live_..."` sometimes pass the literal quotes through, especially on Windows.
• Restricted key missing the required permission. Restricted keys (`rk_test_*` / `rk_live_*`) are scoped. If the operation you're calling needs a permission the key wasn't granted (e.g., creating a charge with a key that only has read access), Stripe returns `api_key_invalid` rather than a permission-specific error.

How to fix it

Fixes are ordered by likelihood. Start with the first one that matches your context.

const key = process.env.STRIPE_SECRET_KEY;
if (!key) throw new Error('STRIPE_SECRET_KEY is missing');
const expected = process.env.NODE_ENV === 'production' ? 'sk_live_' : 'sk_test_';
if (!key.startsWith(expected)) {
  throw new Error(
    `STRIPE_SECRET_KEY mode mismatch: expected ${expected}, got ${key.slice(0, 8)}…`
  );
}

const raw = process.env.STRIPE_SECRET_KEY;
const key = raw?.trim().replace(/^['"]|['"]$/g, '');
console.log('Stripe key length:', key?.length, 'prefix:', key?.slice(0, 8));
if (!key || key.length < 100) {
  throw new Error('STRIPE_SECRET_KEY looks malformed');
}
const stripe = new Stripe(key);

Detection and monitoring in production

Alert on any `StripeAuthenticationError` immediately — they should be near-zero in steady state. A sudden burst means a deploy shipped with the wrong env or someone rolled the key. Tag errors by `process.env.NODE_ENV` and the key prefix (first 8 chars) so you can tell mode mismatches from key revocations at a glance.