November 5, 2026. Stripe's MCP server, the endpoint at mcp.stripe.com that lets AI agents read and write Stripe data, stops accepting full-access secret keys and restricted keys without the Agent tag in December. Stripe's MCP documentation says "Migrate by 30 November 2026" and that requests using an unsupported key "receive a 401 response with an OAuth discovery challenge." An agent still connected with an old key has 25 days to migrate; Stripe says the refusals start in December.
Key numbers
| Item | Number |
|---|---|
| Migrate by (25 days after this article) | November 30, 2026 |
| Old keys refused from (full-access secret keys and untagged restricted keys) | December 2026 |
| Response to an unsupported key (with an OAuth discovery challenge) | HTTP 401 |
| Unapproved agent action expires after | 24 hours |
| Server status | Public preview |
Stripe's MCP and API keys documentation, read on 5 November 2026.
What Stripe's docs say
- Two ways in. OAuth for interactive clients, which "lets you authorise and revoke a client without sharing an API key", and agent API keys for autonomous clients that cannot use OAuth. Agent keys carry an Agent badge in the Dashboard and go in the Authorization header as a bearer token.
- Agent keys come with approval rules. Stripe's API keys page says agent-tagged keys "are automatically subject to approval rules, which require a designated reviewer to approve sensitive actions before they take effect", with default rules "covering elevated-risk actions such as payouts and refunds."
- Unapproved requests expire. On the MCP page, Stripe says it "can require you to review and approve the request in the Dashboard" before an agent completes certain actions. After you approve, "you need to tell the agent to retry the operation", and "If you don't approve the action within 24 hours, it expires."
- Connected accounts need a key, not OAuth. "MCP doesn't support OAuth when acting on behalf of connected accounts." Stripe says Connect platforms should use a platform agent API key with only the connected-account permissions the agent needs.
- Admins can switch MCP off. Access can be turned on or off for a whole team, separately for live mode and sandboxes.
Developers Digest's Stripe MCP setup guide, which logged the docs as of October 17, reports the same December cutoff. Stripe still labels the server Public preview. The new step is the key cutoff; the rest is how Stripe documents the options today.
What it means for operators
The notice covers the MCP server only. It says nothing about keys used directly against the Stripe API, such as a checkout integration. What it does catch is the shortcut of pasting a live secret key into an AI assistant's MCP settings so it can look up customers or issue refunds.
- Interactive clients: reconnect with OAuth. Stripe recommends OAuth for MCP clients a person uses directly, such as a coding assistant.
- Autonomous agents: replace the key with the smallest permissions that work. Stripe's steps: create an agent API key with only the permissions the client needs, test the new configuration in a sandbox, then expire the old key. When Stripe asks what the key is for, pick "Giving an AI agent access to operate your account".
- Plan for the pause. Agent keys come with approval rules for actions such as payouts and refunds, so an unattended refund agent will wait for a person. Name a reviewer who acts within 24 hours, and after approval tell the agent to retry.
- Turn on client approval. Stripe asks you to turn on your MCP client's tool-approval setting and warns about prompt injection when Stripe MCP runs alongside other servers.
Agencies that resell a white-label GoHighLevel SaaS billed through Stripe should still check whether anyone on the team gave an AI assistant the account's live key. If you are wiring agents into payments, our AI engineers can help scope keys and approvals, and our SaaS launch package includes Stripe payments. For another change to an agent platform, see OpenAI's Agent Builder shutdown.
Frequently Asked Questions
Agent-tagged keys, yes. Full-access secret keys and restricted keys without the Agent tag only until the November 30, 2026 migration date: Stripe says that starting in December its MCP server will stop accepting them. Use OAuth for interactive clients or an agent API key for autonomous ones.
A secret key tagged for an AI agent that needs persistent access to your account. It enforces permissions like other secret keys, carries an Agent badge in the Dashboard, and is automatically subject to approval rules, with defaults covering elevated-risk actions such as payouts and refunds.
Stripe says requests using an unsupported key receive a 401 response with an OAuth discovery challenge, so the agent's Stripe tool calls will fail until you reconnect with OAuth or a new agent API key.
No. Stripe says MCP does not support OAuth when acting on behalf of connected accounts. Connect platforms authenticate with a platform agent API key that has only the connected-account permissions the agent needs.