Hi help please unable to update Stripe secret key in Supabase keeps reverting back to old one.
Issue: "Secret key automatically reverting to incorrect value after being updated"
Steps taken: Full browser reset, multiple attempts to update secret
Impact: Cannot process payments due to incorrect Stripe key
23 Replies
So this is a strange one, i think you said earlier that if you try to use a different secret name (lets say STRIPE_NEW_SECRET_KEY) it would still not work?
as in it would use your old secret key?
Hi thanks so much for getting back to me that's correct! I followed fix offered on chat it automatically revert to old secret key no matter if I rename and save it.
how do you know that it is using the old secret key, are you fetching it via Deno.env.get("STRIPE_SECRET")?
i should have asked actually, this is in a stripe webhook i assume? or an edge function
When I add a new secret key and save it when scrolling down the page I can see it added in the list of all my secret keys in Supabase edge funcctions but it hasn't taken the new value shows old one which is not even correct
because the secret key is hashed, you won't be able to read it after you write it so how are you sure that it is not reading it properly?
My secret keys are stored in edge functins and I know for sure it shouldn't start with just numbers but with sk I can see what's in my stored keys and it's not the new one at all
have you migrated over to the secret key and publishable key completely?
I'm sorry all this is a bit a jargon for me I'm not techy at all don't understand anything about it all.All I know is all my publishable key and secret keys were saved in Edge functions
If you go into project settings -> API keys you should see 'Legacy API Keys' and 'API Keys'
does it look like you have moved off legacy API keys (which maybe what you see) to the new API keys publishable and secret
wait sorry
I can see that now never been there before
it's late and i'm forgetting that you are talking about stripe not supabase keys
ignore that section then, its not relevant
oh ok
Thanks for trying to help anyway I appreciate it
here is a screenshot of my edge function page, are you aware the middle value is not the actual secret but the hashed value of the secret?
i'm just confused because if you create a new secret set it to RANDOM_VALUE, i don't see how it could tell that this is the old value but are you saying that middle number never changes despite what you call your variable name?
Can I ask where do you get this info Stripe_WEBHOOK_SECRET? All my keys are listed in the Edge functions in here plus the chat confirmed that I need to create a new one and that it should start sk so I'm kind of confused
i created this secret myself go into edge functions -> secret. set the key value as STRIPE_WEBHOOK_SECRET and set the value as your stripe secret key (you may have been doing it the other way around i.e you set key as the stripe value and value as the name) and press save.
you should see STRIPE_WEBHOOK_SECRET then in your secrets and you can use it
How are we supposed to know this when we have no knowledge I relied purely on the chat guidance who told me where to go sending screenshot etc. it confirmed I was in correct place I'm so confused
there's no stripe webhook at all in my secret
you have to add it, you can call it STRIPE_SECRET that is fine
I see what you mean thank you I did put it the other way around now you mentioned I will try it now.
Seems strange though if I do that it shows the whole secret key no name.I've entered the sk key in the e.g client key field then named value STRIPE_SECRET correct?
no the name should go in the client key field, you shouldn;t see sk_* anywhwere and you should delete that entry because thats not safe
So I had it correctly entered from the start there is something not right whatever update I do renaming it...It's not updating. I just can the previous one still there.Ok I've deleted what I've done.
Apologies, i'm really not sure what this issue might be. Perhaps reach out to their suppport?
Thanks for the help appreciated I did reach their support 2 days and waiting to see if they will investigate I hope so.