StripePaymentsAPI

Stripe: cannot use a test key in live mode

Cannot use the test mode key 'sk_test_...' in live mode. Please use a live mode key instead.

In short: One part of your Stripe setup is in test mode and another is in live mode, so the keys don't belong together.

Why it happens

Stripe treats test and live as two separate environments. A secret key (sk_test_ / sk_live_), publishable key (pk_test_ / pk_live_), webhook signing secret, Checkout session, and customer id all have to be from the same mode. Vibe-coded apps often keep pk_test_ in the frontend, put sk_live_ in production env vars, or create a Checkout session in test and then redirect to a live Checkout page. The dashboard's Test/Live toggle also switches which webhook endpoints and secrets you see.

How to fix it

1. Check every Stripe key the app uses. They must all start with the same mode: *_test_ for test, *_live_ for live.
2. In the Stripe Dashboard, flip the Test mode switch to match the keys you're inspecting. Copy the publishable and secret keys from that mode only.
3. On your host, set STRIPE_SECRET_KEY and NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY (or your names) as a pair, then redeploy.
4. Use test webhook secrets (whsec_) with test events, and the live endpoint's secret with live events. A secret from stripe listen is only for local test events.
5. Don't reuse test customer, price, or subscription ids in live mode; create those objects again under live keys.

Copy-paste fix prompt

I'm getting this error in my app:

Cannot use the test mode key 'sk_test_...' in live mode. Please use a live mode key instead.

[Paste the full error, stack trace, and the file it points to here]

Likely cause: One part of your Stripe setup is in test mode and another is in live mode, so the keys don't belong together.

Task: List every Stripe key, webhook secret, and object id the app uses, mark each as test or live, and make each environment use a matching set. Don't put a secret key in client code.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Cursor, Bolt, Lovable, Replit. Last reviewed 2026-11-15.