---
title: "Platform operators: whether Stripe keys are stored (never the keys), their mode and last test, what billing uses now, the webhook URL"
method: GET
path: "/operator/payment-keys"
tags: ["Operator"]
---

# Platform operators: whether Stripe keys are stored (never the keys), their mode and last test, what billing uses now, the webhook URL

`GET /operator/payment-keys`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/operator/payment-keys`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Response `200`

Status

- object
  - `stripe` object, required
    - `secretKey` object, required
      - `keySet` boolean, required
      - `setAt` string, nullable, required: ISO-8601 timestamp
      - `setByEmail` string, nullable, required
      - `mode` 'test' | 'live' | 'null', nullable, required: test or live (from the key's prefix); the key itself is never answered
      - `testedAt` string, nullable, required: ISO-8601 timestamp
      - `testOk` boolean, nullable, required
      - `testDetail` string, nullable, required
    - `webhookSecret` object, required
      - `keySet` boolean, required
      - `setAt` string, nullable, required: ISO-8601 timestamp
      - `setByEmail` string, nullable, required
    - `environment` object, required: keys in the server's environment (STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET): used for what is not stored here
      - `secretKey` boolean, required
      - `webhookSecret` boolean, required
    - `active` object, required: what billing uses right now
      - `configured` boolean, required
      - `source` 'console' | 'environment' | 'null', nullable, required
      - `mode` 'test' | 'live' | 'null', nullable, required
      - `webhooks` boolean, required
    - `webhookUrl` string, nullable, required: the endpoint to add under Stripe → Developers → Webhooks
  - `keyringConfigured` boolean, required: the platform key (ENCRYPTION_KEY) that seals stored keys is set
  - `primaryBrand` boolean, required: false: this is not the main brand; Stripe keys are entered in the main brand's console

## Other responses

- `400`: Invalid request (code invalid_request); details.reason says what to fix
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden); operator writes may need a fresh session (details.reauthenticate)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicting state (code conflict): details.reason taken, premium, owned, pending_order, price_changed, dns_changed (reload the records), dns_busy, dns_not_here, conflicting_records (details.records), …
- `429`: Too many searches or DNS requests (code rate_limited); see Retry-After
- `501`: Not set up on this server (code not_configured), e.g. no registrar key yet
- `503`: The registrar did not answer (code provider_unavailable)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)