Accept rk_live_ restricted keys for the live Stripe key (least-privilege restricted key path for the murals go-live) (TK-10181)

87f0e4ac569a15147e054c0e66cf7e84c9aa0505 · 2026-08-04 11:25:55 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 87f0e4ac569a15147e054c0e66cf7e84c9aa0505
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Aug 4 11:25:55 2026 -0700

    Accept rk_live_ restricted keys for the live Stripe key (least-privilege restricted key path for the murals go-live) (TK-10181)
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 2a9f80c..b28c4c6 100644
--- a/server.js
+++ b/server.js
@@ -61,7 +61,7 @@ function envVal(name) {
 }
 const STRIPE_LIVE_ENABLED = envVal('STRIPE_LIVE_ENABLED') === '1';
 const _testKey = (() => { const k = envVal('STRIPE_TEST_SECRET_KEY'); return k && k.startsWith('sk_test_') ? k : null; })();
-const _liveKey = (() => { const k = envVal('STRIPE_LIVE_SECRET_KEY'); return k && k.startsWith('sk_live_') ? k : null; })();
+const _liveKey = (() => { const k = envVal('STRIPE_LIVE_SECRET_KEY'); return k && /^(sk|rk)_live_/.test(k) ? k : null; })(); // rk_ = a scoped restricted live key (least-privilege)
 const STRIPE_LIVE = STRIPE_LIVE_ENABLED && _liveKey;      // real-money mode active?
 // PER-FLOW keys (Steve 2026-08-04: "go live on murals only, keep downloads in
 // test until payouts exist"). MURALS charge real cards once the live switch is

← 6db34b0 AdSense Auto-ads integration (Steve request 2026-08-04): loa · back to CelebritySignatures · Pre-built reserved AdSense ad zones (gallery/article/game) — cc24002 →