If you sell anything through Stripe, sooner or later a tool will ask you for an API key. A dashboard widget, a reporting script, a menu-bar app. The fastest path is to copy your secret key and move on. Please don't. Stripe gives you a much safer option, and it takes about three minutes.

This is the checklist I follow before I give any desktop tool access to revenue data.

1. Never hand over the full secret key

Your standard secret key (sk_live_...) can do almost everything: create charges, issue refunds, change products. A tool that only needs to read numbers should never hold that much power. If the app or your laptop is ever compromised, the blast radius should be "someone saw my revenue", not "someone refunded my customers".

2. Create a restricted key instead

In the Stripe Dashboard, go to Developers → API keys → Create restricted key. Give it a name you will recognise later, such as the name of the app and the Mac it runs on. Restricted keys start with rk_live_.

3. Grant read access only, and only to what is needed

For a revenue view you usually need Read on charges, payment intents, and balance transactions. Leave everything else at None. If a tool asks for write permissions just to show you a number, treat that as a red flag.

4. One key per device and per tool

Create a separate key for each app and each machine. It feels tedious, but it means you can revoke one without breaking anything else, and the key's "last used" date tells you exactly which install is still talking to Stripe.

5. Check where the key is stored

A good desktop app keeps credentials in the operating system's secure store (on macOS, that is the Keychain), not in a plain config file. Also ask: does the app send your key or your revenue to its own servers? Ideally the answer is no, and the Mac talks to Stripe directly.

6. Be realistic about refresh rates

Many lightweight tools poll Stripe on a schedule rather than streaming events. That is fine for a glanceable number, as long as you know the schedule. If the app says "syncs every couple of hours", don't expect a payment to show up the second it lands.

7. Revoke keys you no longer use

Every few months, open the API keys page and delete restricted keys that haven't been used recently. Old keys are forgotten keys.

How this looks in practice

I built Notch Revenue around this checklist. It is a small native Mac app that shows today's and this month's Stripe revenue in the MacBook notch (it draws a virtual notch on Macs and displays without one).

  • It only asks for a restricted read-only key, which is stored in the macOS Keychain.
  • Your revenue data never leaves your Mac; there is no server in the middle.
  • It syncs at launch and about every two hours, plus a manual refresh. It is not a real-time feed.
  • When a sync finds a new payment, there is a quiet confetti pop. Payments imported during the first connection don't trigger it.
  • Multiple Stripe accounts are supported, each with its own key.

It needs an Apple Silicon Mac running macOS 14 or later and costs US$19.99 once, with no subscription.

Whatever tool you end up using, the checklist is the part that matters: restricted, read-only, one key per install, stored safely, revoked when you are done.

Notch Revenue: https://notchrevenue.com