StripeInspector

No Data Collection

StripeInspector does not store, log, or transmit any API keys entered into this tool. All requests go directly from the server to the Stripe API. No keys are saved to disk, databases, or any external service.

Self-Hosted

This tool is designed to be self-hosted. When you run stripe-inspector serve, the server runs on your own machine. Your keys never leave your network unless you choose to expose the server.

Ethical Use Only

This tool is intended exclusively for:

• Authorized penetration testing engagements
• Bug bounty programs
• Security research and education
• Testing your own API keys

Only use this tool on API keys you own or have explicit written permission to test. Unauthorized access to third-party systems is illegal.

No Warranty

This tool is provided "as is" without warranty of any kind. The authors assume no liability for any damage, loss, or legal consequences resulting from the use or misuse of this tool. You are solely responsible for ensuring your use complies with all applicable laws and regulations.

Key Masking

All reports and outputs automatically mask API keys, showing only the first 8 and last 4 characters. This reduces the risk of accidental key exposure in shared reports.

Installation

pip install stripe-inspector

CLI Usage

# Inspect a key (all modules)
stripe-inspector inspect sk_test_xxxx

# JSON output
stripe-inspector inspect sk_test_xxxx --output json

# Generate HTML report
stripe-inspector inspect sk_test_xxxx --report findings.html

# Deep scan (fetch all pages)
stripe-inspector inspect sk_test_xxxx --deep

# Specific modules only
stripe-inspector inspect sk_test_xxxx --modules account,customers,charges

# Batch scan multiple keys
stripe-inspector batch keys.txt --report-dir ./reports

Web UI

# Start local server
stripe-inspector serve

# Custom port with auth
stripe-inspector serve --port 9000 --token mysecret

Modules (17)

account, balance, customers, charges, payment_intents, products, payouts, subscriptions, invoices, webhooks, events, connected, disputes, refunds, balance_transactions, coupons, permission_scan

Key Types Supported

Output Formats

• Table — colored terminal tables (default)
• JSON — pipe to jq, scripts, etc.
• HTML Report — standalone file for sharing
• PDF Report — pip install stripe-inspector[pdf]

This will save the inspection results on the server running this StripeInspector instance.

• No API keys are included — keys are always masked
• The link is accessible to anyone with access to this server
• The link expires after 24 hours

Only share with people authorized to view the inspection results.