Pasting a Stripe API key into chat makes it part of the conversation. Put it in your vault instead. Wundervault's helper app on your computer makes the Stripe request. Your agent gets the answer with the key removed.
This guide ends with a first balance check. The key goes into the vault's form, not into a message to your agent.
1. Set up your vault and computer
If you are new to Wundervault, create your vault. Then follow Set up a computer to install the helper app and pair it with your vault.
Do the installation and pairing yourself, in a terminal your agent is not using. Check that the fingerprint in your vault matches the one on the computer before you pair.
Already have a paired computer? Continue below.
2. Add your Stripe API key
For this first check, use a test secret key from Stripe. Open Stripe's API keys page. Test secret keys start with sk_test_. A publishable key or a webhook signing secret is not the key for this example. Stripe explains the differences in its key guide.
In your vault:
- Choose Add a secret.
- Under What is this key for?, type Stripe and choose it.
- Paste the key into Secret key. Paste only the key, without the word
Bearer. - Read the line that says how it is sent. It should say it goes to
api.stripe.com. - Give it a name you will recognise, such as Stripe test, and save.
Stripe is on Wundervault's list of services, so the form already knows how Stripe expects the key. You do not build anything yourself. How the secret form works.
3. Connect your agent
If the agent is already connected to this computer's helper app, skip this step.
- In your vault, choose Add an agent.
- Give the agent a name and choose the computer it runs on.
- Choose Make the agent.
- Under Message for your agent, choose Copy message and paste that message into the agent's chat.
That message contains a one-time code, not your Stripe key. It works once, only on the computer you chose, for 15 minutes. The agent connects itself. Help connecting an agent.
4. Give the agent access to this secret
Open your Stripe secret. Under Who can use it, turn your agent on.
Choose Asks me first for this walkthrough. A use waits for you to approve it, and nothing is sent before you do. Runs without asking is the other choice; it lets the agent use the secret without waiting for you. Help with access.
Then ask your agent to list your vault secrets. It should name your Stripe entry. The list holds names and kinds of secret, never their values.
5. Ask for the first Stripe call
Give your agent this task. There is no key in it:
Use my Stripe test secret through Wundervault to retrieve the account balance. Make only a GET request to https://api.stripe.com/v1/balance. Report the available and pending balances. Do not create or change anything.
Stripe documents this request under Retrieve balance.
The agent's request names your Stripe entry, the address api.stripe.com, the method GET and the path /v1/balance. It carries no key. The helper app adds the key on your computer, from what you saved. The MCP reference has the details.
When the request is waiting, open Approvals. Check that it goes to api.stripe.com, that the method is GET and that the path is /v1/balance. Choose Once to approve that one call.
6. Check what came back
Stripe returns your balance: available and pending amounts. The helper app passes Stripe's answer to your agent with your stored key removed. Your agent can read the balance and explain it to you. It never needs to read the key.
Open Activity in your vault to see the use. If the agent sees no secrets, check Who can use it. If it says the helper app is not running, follow Check it works.
Keeping the key hidden does not limit what it can do
This walkthrough asks for a read-only call. That does not make the key read-only. Your agent can do whatever the Stripe key itself is allowed to do. Read Stripe's guidance on keys before you use a live key, and prefer a restricted one.
Stripe's answer can contain account data the key is allowed to read. Wundervault removes the stored secret; it does not hide Stripe's data from your agent. With Runs without asking, the agent chooses where a request goes, so a tricked agent could send the key somewhere else. Use Asks me first for secrets that matter.
Already pasted a key into an agent's chat? Moving it to a vault cannot take that copy back. Replace the key at Stripe, then save the new one in Wundervault.
Our limitations page has the full boundaries. To stop this agent using the Stripe secret, turn it off under Who can use it.