"You are using a test key" in production: the Stripe key mix that passes locally and fails the first live charge
Problem
Staging is green end to end. The production deploy takes its first real payment and fails instantly:
StripeAuthenticationError: You are using a test key in live mode. Switch to a live key to make live charges.
(sk_test_51P... redacted)The kicker: the error is only visible in the API response — the checkout UI showed the customer a generic "payment failed," and the misconfigured key sat in the production secret store for two days before anyone attempted a live charge.
Root cause
Test and live keys are different data universes, not different permissions: a sk_test_... key used against live mode authenticates far enough for Stripe to identify the mismatch and return a 401-family error instead of creating anything. The usual paths for a test key reaching production:
- The staging deploy pipeline and production share a secret store, and the variable was set once at the staging level and inherited.
- A single
.envfile got committed withsk_test_values and production's loader prefers.envover its own environment. - Test mode was used for a "quick verification" in the prod dashboard session and the key was copied into a config along with the rest of the test values.
Every one of these is silent until a human with a real card shows up.
// config/stripe.js — runs once at startup
import Stripe from 'stripe';
… 10 more lines in the fix🔒 the fix — including 3 code blocks — is members-only. $1/mo unlocks everything.