---
title: "Configure live Stripe keys"
method: POST
path: "/api/apps/{app_id}/payments/stripe/configure-live-keys"
---

# Configure live Stripe keys

`POST /api/apps/{app_id}/payments/stripe/configure-live-keys`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/payments/stripe/configure-live-keys`
- Auth: HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Switches the app to live mode using live Stripe keys you already have from the Stripe dashboard, sent directly in the request body, rather than keys Base44 creates for you. Use [Provision live Stripe keys](/api-reference/provision-live-stripe-keys) instead to have Base44 create them automatically once the sandbox's Stripe account is activated.

Stores the keys, backs up the current test credentials, and redeploys backend functions with the updated secrets.

Base44 checks the key prefixes and retrieves the secret key's Stripe account. When that account differs from the sandbox's installed live account, Base44 registers a separately signed webhook for payment analytics before storing the keys. The secret key needs account read and webhook management permissions for this setup. Base44 doesn't verify that the publishable key belongs to the same account or that the account can process payments.

Automatic migration of an existing app-function webhook remains best effort.

If retiring the previous analytics destination fails, the new keys may already be stored. Retry the same configuration to finish the pending setup.

Requires write access to the app. Workspace viewers cannot call this operation.

## Path parameters

- `app_id` string, required: ID of the Base44 app.

## Request body

- ConfigureLiveKeysRequest: Request to configure live mode API keys.
  - `publishable_key` string, required: Live Stripe publishable key beginning with `pk_live_`.
  - `secret_key` string, required: Live Stripe secret or restricted key beginning with `sk_live_` or `rk_live_`.
  - `webhook_secret` string, nullable: Live webhook signing secret beginning with `whsec_`. Defaults to `null`, which attempts automatic migration when an existing webhook secret is present.

## Response `200`

The operation result.

- StripeLiveKeysResult: The result of storing live Stripe credentials.
  - `success` boolean, required: Whether live keys were stored and the app was switched to live mode.
  - `message` string, required: Human-readable configuration result.
  - `live_keys_configured` boolean, required: Whether the stored completion flag was confirmed. It can be `false` even after keys were stored if finalization failed.
  - `webhook_migrated` boolean, required: Whether this call automatically migrated the webhook. It is `false` when a webhook secret was supplied directly.

## Other responses

- `400`: A key has an invalid prefix, Stripe rejects the secret key or webhook setup, or the key lacks account read or webhook management permissions.
- `401`: Missing or invalid credentials.
- `403`: The credential is not permitted or you don't have the required app access. A missing app also fails the app access check. Setup and catalog operations also return `app_payment_management_not_allowed` when the app's workspace restricts payment management.
- `404`: No Stripe sandbox exists or the app is outside the credential grant.
- `409`: `stripe_tracking_account_mismatch`: Restore the previous account's key and retry. `stripe_tracking_setup_in_progress`: Finish configuring the pending account, or disconnect Stripe before switching accounts.
- `422`: The body is missing, `publishable_key` or `secret_key` is missing, or a value doesn't match its field's type.
- `503`: `stripe_tracking_setup_unavailable` or `stripe_tracking_secret_unavailable`: Stripe or credential decryption is temporarily unavailable. Retry later.

## Changes

- **2026-10-22** `f1b468479619`: 2 info
  - added the media type `application/json` for the response with the status `409`
  - added the non-success response with the status `503`
- **2026-10-11** `80287813ab84`: 1 info
  - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API
- **2026-09-15** `ca10c5ce328c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/idealspot/apis/base44-app-management-api/changes/api/apps/:app_id/payments/stripe/configure-live-keys/post.md)

---

[API](https://skmtc.dev/idealspot/apis/base44-app-management-api.md) - [All operations](https://skmtc.dev/idealspot/apis/base44-app-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/idealspot/apis/base44-app-management-api/revisions/b5b4ebd82a1e?raw)