Manage API keys and access

Manage sandbox API keys and control user access.

Use the Stripe Dashboard to manage sandbox API keys and grant users access to your sandbox.

Manage API keys

Stripe uses the API keys associated with a sandbox to authenticate API requests to the sandbox environment. We raise an invalid request error if you don’t include a key and an authentication error if the key is incorrect or outdated.

Use the Developer Dashboard within the sandbox to reveal, revoke, and create API keys. Learn more about API keys.

Manage access

You can manage access to each sandbox through direct role assignments in the sandbox or inherited roles assigned outside the sandbox.

Direct role assignments in a sandbox

You can assign a role directly in a sandbox to give a user access to that sandbox by using Team management in that sandbox or organisation sandbox. You can assign a different role in a sandbox than the one the user holds in other sandboxes or in your live account or organisation.

To grant access to organisation sandboxes, you must assign the user a role in your live organisation.

Control inherited role access

You can control which roles are inherited in sandboxes by changing the sandbox’s access level. New sandboxes use the Private access level by default. When you change the access level of an organisation sandbox, all workspace sandboxes in that organisation sandbox inherit the same access level.

You can’t change the access level of a workspace sandbox in an organisation sandbox independently. Team members with the Admin, Super Admin or Sandbox Administrator role in your live account automatically inherit their roles in all sandboxes.

• Private access level: Team members must be invited to access the sandbox. Only the Admin , Super Admin and Sandbox Administrator roles are inherited.
• Developer access level: Team members with the Developer role receive the Administrator role in the sandbox. Team members with the Admin , Super Admin or Sandbox Administrator role keep their existing access. You must invite other team members.
• All team members access level: Team members with a live mode role inherit access to the sandbox, except users who only have the Sandbox User role. You can assign a different role with more permissions in the sandbox.

Grant users access to all sandboxes in an account

When you assign the Sandbox Administrator role to a team member in your live account, they gain access to every sandbox linked to that account.

To add specific team members to all sandboxes connected to your live account with a direct role assignment:

1. Go to your live account in the Dashboard.
2. Click the account picker > Settings in the Dashboard.
3. Click Team and security > + Add member , then enter one or more email addresses. Select the Sandbox Administrator role .
4. Click Send invites .

To grant inherited access to sandboxes connected to your live account:

1. Go to your live account in the Dashboard.
2. Click the account picker > Switch to sandbox > Manage sandboxes in the Dashboard. For each sandbox, click the overflow menu ( ) for the sandbox you want to give all team members access to, then click Change access .
3. Select Developer or All team members .
4. Click Save .

Note

Update the access level for each sandbox when you create it. New sandboxes use the Private access level by default, which requires you to invite users individually.

Grant users access to all sandboxes in an organisation

When you assign the Sandbox Administrator role to a team member in your live organisation, they gain access to every organisation sandbox linked to that organisation, as well as every sandbox linked to the live accounts within your organisation.

To change the access level of an organisation sandbox:

1. In your Organisation Dashboard, click the account picker, then click Switch to sandbox > Manage sandboxes .
2. Click the overflow menu ( ) for the organisation sandbox you want to update, then click Change access .
3. Select an access level.
4. Click Save .

All workspace sandboxes in the organisation sandbox inherit the access level that you set. You can’t change the access level of individual workspace sandboxes in an organisation sandbox.

To add team members to all sandboxes and organisation sandboxes connected to your live organisation with a direct role assignment:

1. Go to your live organisation in the Dashboard.
2. Click the account picker > Settings in the Dashboard.
3. Click Team and security > + Add member , then enter one or more email addresses. Select the Sandbox Administrator role .
4. Click Send invites .

Grant users access for testing only

When you grant a team member the Sandbox User role, you’re granting them access to create sandboxes and delete sandboxes they’ve created.

To invite team members to only the sandboxes associated with your live account or organisation, without granting access to any details of your live account or organisation:

1. Go to your live account or organisation in the Dashboard.
2. Click the account picker > Settings in the Dashboard.
3. Click Team and security > + Add member , then enter one or more email addresses. Select the Sandbox User role .
4. Click Send invites .

Grant users access to a specific sandbox

To invite team members to a specific sandbox or organisation sandbox:

1. Go to the sandbox or organisation sandboxes in the Dashboard.
2. Click the account picker > Settings in the Dashboard.
3. Click Team and security > + Add member , then enter one or more email addresses and select a role.
4. Click Send invites .

Note

If the invited user doesn’t already have a role in the live Stripe account or organisation, Stripe automatically assigns them the sandbox user role, but only if your role lets you add members to that account or organisation.

Revoke user access to sandboxes

To revoke a user’s access:

1. Go to the live account, live organisation, sandbox or organisation sandbox where that user has a role assignment in the Dashboard.
2. Click the account picker > Settings in the Dashboard.
3. Click Team and security , then click the overflow menu ( ).
4. Click Remove member to revoke their access.

You can revoke inherited access to a sandbox with the Developer or All team members access level only by revoking the user’s access to the live account or by changing the sandbox’s access level.

Manage user access to sandboxes with SSO

You can manage access to sandboxes through single sign-on (SSO) SAML assertion by updating the attribute statements to specify roles within a sandbox.

To access a sandbox through SSO, your team member must have the following:

• A role in the livemode parent (the live organisation or live account)
• A role that grants access to sandboxes, in either the specific sandbox or in the live account

The following roles in your live account automatically provide access to sandboxes:

• Admin and Super Admin : Admin and Super Admin users can create, manage and view all sandboxes under the account or organisation.
• Developer : Developer users can create new sandboxes and access any sandboxes they create. They also automatically inherit the Administrator role in any sandbox with the Developer access level.
• Sandbox Administrator : Sandbox Administrator users can create, manage and view all sandboxes under the account or organisation. However, this role doesn’t grant any livemode permissions.
• Sandbox User : Sandbox User users can only access sandboxes. They have no permissions in the livemode account. Like Developers, they can create new sandboxes and access any sandboxes they create themselves.

For more information about these roles, see User roles.

SSO configuration examples

The following examples demonstrate how to configure your identity provider (IdP) to grant access to sandboxes using SAML attribute statements.

Grant users access to a specific sandbox with SSO

To grant a user access to a specific sandbox, your IdP admin needs to send a role attribute with the sandbox account ID in the SAML assertion.

For example, to grant a user the analyst role in a specific sandbox account:

<Attribute Name="Stripe-Role-acct_SANDBOX_ID">
 <AttributeValue>
 analyst
 </AttributeValue>
</Attribute>

Grant users access for testing

To let your team members create sandboxes and delete the sandboxes they create without granting access to your live account or organisation details, assign the sandbox_user role in the live account:

<Attribute Name="Stripe-Role-acct_LIVEMODE_ACCOUNT_ID">
 <AttributeValue>
 sandbox_user
 </AttributeValue>
</Attribute>

You can combine the sandbox_user role with other roles if you want the user to have additional permissions in the live account:

<Attribute Name="Stripe-Role-acct_LIVEMODE_ACCOUNT_ID">
 <AttributeValue>
 analyst
 </AttributeValue>
 <AttributeValue>
 sandbox_user
 </AttributeValue>
</Attribute>

When users have the sandbox_user role, they can create sandboxes and access the sandboxes they’ve created. You don’t need to send a role statement for each individual sandbox.

Grant users access to all sandboxes with SSO

To grant a user access to all sandboxes under a live account or organisation, assign the sandbox_admin role in the live account:

<Attribute Name="Stripe-Role-acct_LIVEMODE_ACCOUNT_ID">
 <AttributeValue>
 sandbox_admin
 </AttributeValue>
</Attribute>

You can combine sandbox_admin with additional roles for the live account or organisation:

<Attribute Name="Stripe-Role-acct_LIVEMODE_ACCOUNT_ID">
 <AttributeValue>
 analyst
 </AttributeValue>
 <AttributeValue>
 sandbox_admin
 </AttributeValue>
</Attribute>

When a user has the sandbox_admin role, they can access all sandboxes. You don’t need to send role statements for individual sandboxes.