## Stripe CLI Keys and Permissions

This section details how the Stripe Command Line Interface (CLI) handles API keys and the permissions associated with them.

### Default Keys and Permissions

By default, when you use your account's secret keys with the Stripe CLI, you have unrestricted access to perform any API request.

### Restricted Keys for Authentication

When you authenticate the Stripe CLI using the `stripe login` command, it automatically generates a set of **restricted keys**. These keys are:

*   **One for a sandbox environment.**
*   **One for live mode.**

These automatically generated restricted keys are valid for 90 days.

### Understanding Restricted Keys

Unlike standard API secret keys, restricted keys generated by the Stripe CLI have limitations on the API requests they can perform. You can create new restricted keys with custom restrictions in the Stripe Dashboard or specify any API key directly using the `--api-key` flag.

### Viewing Your Keys

The Stripe CLI stores your generated keys in two locations:

1.  **Stripe Dashboard:** Navigate to the **API keys** page and look for the **Restricted keys** section.
2.  **Local Machine:** The keys are stored in the `~/.config/stripe/config.toml` file.

### Viewing Key Permissions

To view the permissions associated with your restricted key:

1.  Go to the **API keys** page in your Stripe Dashboard.
2.  Scroll down to the **Restricted keys** section.
3.  Hover over the **Info icon** next to your CLI key name to see its specific permissions.

### Specifying an API Key Inline

You can override the default keys and specify your own API key directly within a command using the `--api-key` flag. This is useful for running requests with specific keys or when you don't want to rely on the stored keys.

**Example:**

```bash
stripe login --api-key sk_test_RXHltS2OKzISvxWQ7NmRN57i001oa6x7o4
```