Security
You're about to connect a payment processor to a tool you didn't write. Here's exactly what that does and doesn't allow — in plain language, because you should be skeptical.
We only accept restricted keys
BillHog rejects full secret keys (sk_…) outright. The only key it will take is a restricted key with read access to Charges and Customers — nothing else.
Read-only means read-only
The key can't create charges, issue refunds, modify customers, or move money in any direction. BillHog never touches funds and never will — that's a permanent product boundary, not a current limitation.
Keys are encrypted at rest
Your key is encrypted with AES-256-GCM before it's written to the database, using a key held outside it. The plaintext is never logged, never returned by our API, and is scrubbed from error reports.
You can revoke access in one click
The key lives in your Stripe dashboard. Delete it there and BillHog loses all access immediately — no email to us, no waiting.
Your customers never get an account
The invoice portal verifies a customer's email with a one-time code, then shows only the payments made with that address. No passwords, no accounts, and no way to see anyone else's data.
Invoices are private documents
Generated PDFs are stored in private object storage and can only be fetched through an authorized request. A bare storage URL returns 403.
Creating the key
In Stripe: Developers → API keys → Create restricted key. Grant Read on Charges and Customers, leave everything else on None.
Charges Read Customers Read (everything else None)