Security Disclosure Recommendation: Check for Unexpected Usage in Stripe

Author: Mykal Machon

This guide is part of Railway's response to the security disclosure published on October 21, 2026.

If you use Stripe with Railway, rotate any secret key that may have been exposed, review request logs and account activity for misuse, and redeploy your services with the new key.

If you have a Stripe secret or restricted API key that may have been exposed, or you see charges, refunds, payouts, or connected accounts you don't recognize, check your Stripe account. Stripe's guidance is to rotate first and investigate second: a key that reached a public repository or a log line is treated as compromised even without evidence of use.

This guide applies the guidelines from Stripe's Protecting against compromised API keys, extended to include Railway-specific operations.

## Rotate the key

Rotating revokes the old key and generates a replacement that works immediately. Stripe's rotation has a built-in overlap window, so you can choose between an instant cutoff and a short migration period.

1. Open the API keys page in live mode and find the exposed key.
2. Click the overflow menu, then Rotate key.
3. Select an expiration. For a confirmed leak, select Now so the old key is deleted immediately. For a precautionary rotation, select a window long enough to redeploy and verify. See Rotate an API key.
4. Copy the new key and store it in your secrets manager.
5. Rotate every other secret and restricted key on the account too.

## Update the key on Railway

A Stripe key on Railway is a variable, so updating it is a variable edit and a redeploy.

1. Open the service that uses the key and click Variables. If the key is a shared variable, edit it once in Project Settings and every service that references it picks up the change.
2. Edit the variable to the new key, then deploy the staged change. Each affected service redeploys with the new value.
3. If you also rotated a webhook signing secret, update that variable the same way. Webhook secrets are separate from API keys. Find them under Webhooks.
4. Confirm the new deployment is active, then open the new key's overflow menu and click View request logs to confirm requests arrive with the new key.

## Review for misuse

Stripe keeps request logs per key, including for rotated and deleted keys, so you can see exactly what the old key did.

1. On the API keys page, open the old key's overflow menu and click View request logs. Look for IP addresses, endpoints, and request volumes that don't match your integration.
2. Review Payments for charges and refunds you didn't make, and refund fraudulent charges.
3. Review Payouts and external bank accounts. Remove bank accounts you didn't add.
4. Connect platforms: review connected accounts and pause or reject any you don't recognize. See Pausing payments or payouts.
5. Review Webhooks for endpoints you didn't create. An attacker-added endpoint receives a copy of every event.
6. Review Team and security for members and roles you didn't add, and the account's security history for setting changes you don't recognize.
7. Export anything you may need as evidence before you clean up. See Stripe: API keys.

If you have any other questions, contact Railway support at [email protected].