Seu agent cobra clientes (com sua chave Stripe)

Seu agent cobra clientes (com sua chave Stripe)

What just happened (October 2026):

Vercel announced managed Stripe API keys:

"Problem: Agent processes payments (Stripe integration)."

"Current practice: Agent uses your full production Stripe key (master key)."

"Risk: If agent gets compromised, attacker has full Stripe access (charge customers, refund, delete, access data)."

"Solution: Vercel creates separate restricted key per agent task."

"Example: 'Process trial charges' agent = key that ONLY charges (can't refund, can't delete, can't access customer data)."

"Key benefit: Compromise scope = limited to that specific agent's permissions."

What this means for your company:

Current situation (your SaaS agent handling payments):

Setup (typical agent payment integration): Your agent: Subscription agent (WhatsApp, creates trial accounts) Agent's task: Charge customer for trial (R$50) Agent's access: YOUR full Stripe master key - Can charge customers: YES - Can refund: YES - Can delete charges: YES - Can access customer payment history: YES - Can create refunds: YES - Can read card data: YES - Can change billing settings: YES - Can access all customers: YES Your risk: Agent has keys to your Stripe kingdom

What could go wrong: Scenario 1 (agent gets jailbroken): Attacker: Compromises agent via prompt injection Attacker: "Charge me R$0.01, refund R$1.00" Agent: Has permission to do it (master key) Agent: Creates refund loop (infinite money) Impact: Your account gets negative balance, Stripe suspends you Cost: Fraud investigation, account suspension, reputation damage

Scenario 2 (agent has bug):
  Bug: Agent charges customer twice (logic error)
  Agent: Uses master key (can do anything)
  Agent: Charges customer 100 times (loop bug)
  Impact: Customer charged R$5,000 instead of R$50
  Cost: Chargeback, lawsuit, apology
  
Scenario 3 (disgruntled employee):
  Employee: Has agent code/key access
  Employee: Uses agent to charge competitor customers
  Impact: Massive fraud, you're liable (your key = your responsibility)
  Cost: Criminal investigation, civil liability, shutdown
  
Scenario 4 (API exposed):
  Developer: Accidentally commits Stripe key to GitHub
  GitHub: Key exposed (even if quickly deleted)
  Attacker: Finds key, charges customers via your account
  Impact: Fraud happens before you notice
  Cost: Dispute chargebacks, criminal investigation
  

All scenarios enabled by: Using full master key for agent

---

The master key problem (why it's dangerous)

What is a Stripe master key (full access)

Your Stripe secret key = keys to entire account

Stripe master key permissions:

What it can do: - Charge customers (any amount) - Refund charges (any amount) - Delete charges - View customer payment methods - Create customers - Delete customers - Modify billing settings - Access transaction history - Create refunds (legitimate or fraudulent) - Issue disputes - Access API logs - Modify webhook endpoints - Change account settings - Access all financial data - Create/revoke other API keys

In short: Master key = FULL CONTROL over Stripe account

Why companies use it: "Agent needs to charge customers" "So we give it the master key" "Simplest approach (one key, all access)" "Don't think about: What if key gets compromised?"

The problem: Master key = ultimate privilege Should be: Locked in safe, never shared Actually is: Hardcoded in agent, deployed to production, accessible if agent hacked

The compromise scenario (attacker gains access)

If agent key is compromised, attacker gets everything

Attack chain:

Step 1: Attacker compromises agent Method: Jailbreak prompt, SQL injection, insecure deployment Result: Access to agent environment

Step 2: Attacker finds Stripe key Location: Environment variables, hardcoded config, memory Effort: Trivial (key is right there, not encrypted) Result: Attacker has full Stripe key

Step 3: Attacker uses key Actions: Option A: Charge customers (steal money) Attacker: Creates 1,000 charges (R$100 each) Total: R$100,000 stolen Timeline: 30 seconds

  Option B: Refund fraud (refund loop)
    Attacker: Charges customer, refunds to own account
    Repeats: 1,000 times
    Impact: Account goes deeply negative
    
  Option C: Exfiltrate data
    Attacker: Downloads all customer payment methods
    Uses: For separate fraud ring
    Impact: 10,000 customer cards compromised
    
  Option D: Disable billing
    Attacker: Modifies webhook endpoints
    Changes: All future charges go to attacker's account
    Timeline: Persistent access (months)
    

Step 4: You discover (too late) Timeline: Hours or days later Damage: Already done Chargebacks: Customers dispute charges (R$100k+ in disputes) Investigation: Stripe fraud team involved Account: Probably suspended

Cost analysis: Direct fraud: R$100k+ Chargebacks/disputes: R$200k+ Stripe fees: Account closure Reputation: Destroyed (data breach) Legal: Potential criminal liability Total: R$500k - R$5M+ impact

Why this happened: You used master key for agent Master key = full access Compromise = full access leaked Result = unlimited damage

The real-world example (why this matters)

This isn't theoretical - it happens

Real attack scenario (simplified):

Company: Brazilian SaaS (subscription billing) Agent: Automation agent (WhatsApp, manages trials) Implementation: Agent uses Stripe master key

Attack: Month 1: Attacker jailbreaks agent (prompt injection) Month 1: Attacker gains Stripe key access Month 1: Attacker tests: Charges test account R$0.01 Month 1: Test successful (key works) Month 2: Attacker scales: Charges 500 customers Month 2: Customers report unauthorized charges (complaints spike) Month 2.5: Company notices (chargebacks start) Month 3: Stripe investigates (account suspended) Month 3.5: Company discovers root cause (agent compromised) Month 4: Crisis (PR disaster, lawsuits)

Timeline: 4 months Damage: R$1M+ (fraud + chargebacks + legal) Could have been prevented by: Restricting agent's Stripe key

Lesson: Don't give agent master key Solution: Give restricted key (charge ONLY, nothing else)

---

How Vercel solved it (restricted API keys per task)

The restricted key model (minimum access per agent)

Each agent task gets its own limited key

Traditional approach (dangerous):

Agent: Subscription agent Key: Stripe master key (full access) Permissions: Everything

Vercel's approach (safe):

Agent Task 1: "Charge trial subscription" Key: trial_charge_key Permissions: charges:create ONLY Limits: - Can create charge: YES - Can refund: NO - Can delete: NO - Can access customer data: NO - Can modify account: NO Scope: Limited to charges:create action

Agent Task 2: "Create customer record" Key: customer_create_key Permissions: customers:create ONLY Limits: - Can create customer: YES - Can charge: NO - Can refund: NO - Can delete: NO - Can access payment history: NO Scope: Limited to customers:create action

Agent Task 3: "Send invoice" Key: invoice_send_key Permissions: invoices:send ONLY Limits: - Can send invoice: YES - Can modify invoice: NO - Can delete: NO - Can refund: NO Scope: Limited to invoices:send action

Result: Each agent: Limited to its specific task Each key: Can't do anything else Compromise scope: Minimal (one action only) If one key leaked: Damage limited (can't charge, can't refund, can't delete)

Implementation flow (how it works)

Step-by-step: How to create restricted key in Vercel + Stripe

Step 1: Create agent task in Vercel Agent: "Charge trial customers" Task: "Create trial charge" Action: Call Stripe API (create charge)

Step 2: Specify needed permissions Vercel asks: "What Stripe permissions does this task need?" You answer: "charges:create ONLY" You specify: "Can't refund, can't delete, can't access customer data"

Step 3: Vercel creates restricted key Vercel: "Creating Stripe API key..." Vercel: "Permissions: charges:create only" Vercel: "Scope: Limited to this agent task" Vercel: "Expiry: Valid until task disabled"

Step 4: Agent uses restricted key Agent: Receives restricted key (charges:create only) Agent: Tries to charge customer Stripe: Approves (within permitted scope) Agent: Tries to refund Stripe: Denies (not in permissions)

Step 5: Key is confined to agent Key: Only accessible to this specific agent Key: Only works for charges:create Key: Can't be used for anything else

Result: If agent compromised: Attacker only gets charges:create Damage: Can only charge customers (already allowed) Mitigation: Rate limiting, amount limits, user approval Scope: Contained to one action

Comparison: Master key vs restricted key

Side-by-side risk analysis

Scenario: Agent compromised

Using Master Key: Attacker gains: Full Stripe access Attacker can: - Charge customers: YES - Refund charges: YES - Delete charges: YES - Access payment methods: YES - Modify account: YES - Export customer data: YES Damage potential: UNLIMITED (R$1M+) Recovery time: Weeks/months Account risk: Suspension

Using Restricted Key (charges:create only): Attacker gains: charges:create permission ONLY Attacker can: - Charge customers: YES (but with limits) - Refund charges: NO (denied) - Delete charges: NO (denied) - Access payment methods: NO (denied) - Modify account: NO (denied) - Export customer data: NO (denied) Damage potential: Limited (R$10k-50k max with safeguards) Recovery time: Hours Account risk: Minimal

Key difference: Master key: Attacker = admin Restricted key: Attacker = limited operator

Cost comparison: Master key breach: R$500k-5M impact Restricted key breach: R$10k-50k impact Difference: 50-500x worse with master key

---

How to implement restricted keys for your agent

Step 1: Audit current setup (where is your master key?)

Find where agent accesses Stripe

Audit checklist:

1. Identify all agent tasks that use Stripe: [ ] Charging customers [ ] Creating customers [ ] Issuing refunds [ ] Sending invoices [ ] Accessing payment data [ ] Other: ___________

2. Find Stripe key location: [ ] Hardcoded in agent code [ ] Environment variable [ ] Config file [ ] Secret management system [ ] Other: ___________

3. Check key permissions: [ ] Master key (full access) [ ] Restricted key (limited) [ ] Unknown

4. Test current access: [ ] Can agent create charges? YES [ ] Can agent refund? Check... [ ] Can agent delete? Check... [ ] Can agent access customer data? Check...

Questions: "What is our agent actually allowed to do?" "Does it have MORE permissions than needed?" "Are we using master key when we could use restricted?"

If you're using master key: RISK LEVEL: HIGH ACTION: Implement restricted keys immediately

Step 2: Map agent tasks to permissions

For each agent task, specify minimum permissions

Task mapping:

Agent Task 1: "Create trial charge" Needed permission: charges:create NOT needed: - charges:delete - charges:refund - customers:read (customer data) - account:write

Agent Task 2: "Create customer record" Needed permission: customers:create NOT needed: - charges:create - charges:refund - customers:list - account:write

Agent Task 3: "Send invoice" Needed permission: invoices:send NOT needed: - charges:create - charges:refund - invoice:delete - account:write

Agent Task 4: "Issue refund (for support)" Needed permission: charges:refund Limits: - Maximum refund amount: R$1,000 - Can only refund own company's charges: YES - Can't delete charges: NO - Can't refund more than original charge: YES

Principle: Each task = minimum permissions (not maximum) Default: DENY, then grant what's needed NOT: Allow everything, then restrict

Step 3: Create restricted keys (Vercel + Stripe)

Generate separate API key per agent task

Implementation (using Vercel Connect):

Step 1: Open Vercel Connect Go to: Vercel dashboard → Integrations → Stripe

Step 2: Add Stripe connection Click: "Add Stripe Account" Select: "Managed API Key" option

Step 3: Configure permissions For Agent Task 1 (charges:create): Permissions: charges:create Restrictions: None (Stripe default) Expiry: Never (or set if needed)

For Agent Task 2 (customers:create):
  Permissions: customers:create
  Restrictions: None
  Expiry: Never
  

Step 4: Vercel creates keys Vercel: "Creating API key in your Stripe account..." Vercel: "Key 1: trial_charge_key (charges:create only)" Vercel: "Key 2: customer_create_key (customers:create only)" Vercel: "Storing securely in Vercel encrypted storage..."

Step 5: Deploy agent with restricted keys Agent 1: Uses trial_charge_key (charges:create) Agent 2: Uses customer_create_key (customers:create) Agent 3: Uses invoice_send_key (invoices:send)

Result: Each agent: Has its own restricted key Each key: Limited to one permission Compromise scope: Minimal per key

Alternative (if not using Vercel): Create restricted keys manually in Stripe: Stripe dashboard → Settings → API keys → Create Key Set: Permissions (charges:create only) Copy: Key to agent config Repeat: For each agent task

Step 4: Add safeguards (protect even restricted keys)

Multiple layers of protection

Safeguard layers:

Layer 1: Key rotation Strategy: Rotate keys every 90 days Implementation: Automated (Stripe key rotation) Benefit: Old leaked keys become useless

Layer 2: Rate limiting Strategy: Max 100 charges per hour per agent Implementation: Middleware checks rate Benefit: Limits damage if key leaked

Layer 3: Amount limits Strategy: Agent can charge max R$1,000 per transaction Implementation: Validation before charge Benefit: Limits fraud amount

Layer 4: User approval Strategy: Charges over R$100 require approval Implementation: Requires human sign-off Benefit: Prevents automated fraud

Layer 5: Monitoring/alerts Strategy: Alert if charges spike Implementation: Dashboard monitor Benefit: Detect unusual activity quickly

Layer 6: Separate webhook keys Strategy: Webhook endpoint has different key Implementation: Stripe webhook signing Benefit: Webhook key ≠ charge key

Example (complete protection): Restricted key: charges:create only Rate limit: 100/hour Amount limit: R$1,000 per charge User approval: Over R$500 Monitoring: Alert if 20+ charges in 10 min Key rotation: 90 days Result: Even if compromised, damage minimal

---

Migration plan (from master key to restricted keys)

Phase 1: Audit (this week)

Find where master key is used

Action items:

1. List all agent tasks using Stripe
2. Find where master key stored/used
3. Identify minimum permissions needed per task
4. Document current risks

Time: 4-8 hours Cost: Internal (engineer time)

Phase 2: Create restricted keys (next week)

Generate new restricted keys

Action items:

1. Create restricted key in Stripe (per Vercel guide)
2. Test restricted key in staging
3. Verify: Key only has needed permissions
4. Document: Which key for which agent

Time: 1-2 days Cost: Minimal (Stripe key creation = free) Risk: None (testing in staging first)

Phase 3: Gradual migration (2 weeks)

Switch agents one-by-one to restricted keys

Rollout strategy: Week 1: Agent 1: Switch from master to restricted key Monitor: 24 hours (check for issues)

Week 2: Agent 2: Switch from master to restricted key Monitor: 24 hours Agent 3: Switch Agent 4: Switch

Result: All agents on restricted keys Fallback: Keep master key (read-only) if issues

Time: 2-3 weeks Cost: Internal (engineer time) Risk: Low (staged migration with monitoring)

Phase 4: Retire master key (month 2)

Once all agents migrated, disable master key

Action items:

1. Verify: All agents using restricted keys
2. Archive: Keep master key (read-only) for 6 months
3. Rotate: Generate new master key (in case needed)
4. Document: Migration complete

Time: 1 day Cost: None Benefit: Master key no longer accessible (eliminates risk)

---

The bottom line: Don't give agents master keys

Restricted keys = contained damage (if compromised)

Scenario: Agent compromised (jailbreak attack)

With Master Key: Attacker gets: Full Stripe access Damage: R$500k-5M+ (unlimited) Recovery: Weeks/months Account risk: High (possible suspension)

With Restricted Key: Attacker gets: One limited permission Damage: R$10k-50k (limited) Recovery: Hours Account risk: Low

Difference: 50-500x better with restricted key

Implementation effort: Time: 3-4 weeks (phased) Cost: R$30k engineer time ROI: One prevented breach = R$500k-5M saved Payback: Immediate (if breach prevented)

Why wait? Every day with master key = risk exposure Implementation = relatively easy (Vercel + Stripe) Benefit = massive

When should you do it? NOW (before compromise) Not after (too late)

Strategic decision:

Your agent uses your Stripe master key. One compromise = unlimited damage.

Alternative: Restricted keys (limited damage). Implementation: 3-4 weeks. Cost: R$30k. Benefit: R$500k-5M+ if breach prevented.

What's your choice?

→ OpenClaw: Agent Stripe Payment Security, Restricted API Keys, Financial Containment, Payment Transaction Limits, Sandbox Agent Payments

Your agent = Stripe master key (financial liability). Vercel: Restricted keys per task (contained risk). Move NOW. Don't wait for breach. 💳🔐✅