KeyVault.
Node.js / Express

Secure Your Stripe API Key in Node.js

Express apps are frequently misconfigured to expose process.env through /debug or /health routes. A leaked Stripe sk_live_ key gives attackers full access to your payment data. KeyVault Edge host-binding makes the token inoperable anywhere else.

The Problem

This is what most Node.js codebases look like today. The STRIPE_SECRET_KEY key (sk_live_...) lives directly in the process environment. If your repo, your CI logs, or your deployment config leaks — so does your key.

JavaScript
// routes/payments.js — real Stripe key in environment
import Stripe from "stripe";
import { Router } from "express";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
const router = Router();

router.post("/create-payment-intent", async (req, res) => {
  const { amount, currency } = req.body;

  const paymentIntent = await stripe.paymentIntents.create({
    amount,
    currency,
    automatic_payment_methods: { enabled: true },
  });

  res.json({ clientSecret: paymentIntent.client_secret });
});

export default router;

The Fix

Send the request to the KeyVault Edge proxy at https://proxy.keyvaultedge.com with the provider's usual path, your kvt_ token in X-KV-Token and the provider's base URL in X-KV-Target. The proxy refuses requests whose Origin isn't on the token's allowed hosts, then injects your real STRIPE_SECRET_KEY, so it never sits in your app's environment.

JavaScript
// routes/payments.js — KVE_TOKEN is host-bound
import { Router } from "express";

const router = Router();

router.post("/create-payment-intent", async (req, res) => {
  const { amount, currency } = req.body;

  const response = await fetch("https://proxy.keyvaultedge.com/v1/payment_intents", {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded", // Stripe uses form bodies
      "X-KV-Token": process.env.KVE_TOKEN, // kvt_... token, server-side only
      "X-KV-Target": "https://api.stripe.com",
      // Must match one of the token's allowed hosts
      Origin: process.env.APP_ORIGIN,
    },
    body: new URLSearchParams({
      amount: String(amount),
      currency,
      "automatic_payment_methods[enabled]": "true",
    }),
  });

  const data = await response.json();
  res.json({ clientSecret: data.client_secret });
});

export default router;

Setup in 4 steps

1

Create a KVE token for Stripe

Sign in at keyvaultedge.com, create a token with your sk_live_ key, set provider to Stripe, and add your server hostname. Create separate tokens for test (sk_test_) and live (sk_live_) keys.

2

Update .env

Remove STRIPE_SECRET_KEY and add KVE_TOKEN.

Shell
# .env
KVE_TOKEN=kvt_...your_token
APP_ORIGIN=https://yourdomain.com  # one of the token's allowed hosts
3

Replace stripe SDK calls with fetch to KVE proxy

Node.js 18+ has native fetch. Point the request at https://proxy.keyvaultedge.com with the provider's usual path (e.g. /v1/payment_intents), send your token in X-KV-Token, the provider's base URL (https://api.stripe.com) in X-KV-Target, and an Origin header matching one of the token's allowed hosts. The body is the provider's normal request body; the proxy sets the provider's auth header with your real key and forwards it. Stripe expects a form-encoded body.

4

Verify webhook signatures still work

Stripe webhook signature validation (stripe.webhooks.constructEvent) uses your webhook secret, not the secret key. That part of your code doesn't change. Only the outbound API calls go through KVE.

What this protects, and what it doesn't

  • Your real STRIPE_SECRET_KEY stays at the edge, so it can't leak from your repo, logs, bundle or server environment.
  • The kvt_ token is still a credential. A copied token can be replayed by anyone who can send the right headers, including a fake Origin from a server. The protection is that each token has its own rate limits, monthly cost cap and endpoint scope, and you can revoke it in one click without rotating the provider key.
  • The cost cap is estimated from the usage the provider reports, so a request already in flight can overshoot it slightly.

Plans and limits are on the pricing page.

Start protecting your keys

Your Stripe key is one leaked .env file away from being exploited. With KeyVault Edge the real key stays at the edge, and the token that replaces it is capped, scoped and revocable in one click.

Get started View all guides