Error "You are using a legacy-style API key which is unsupported by the CLI" trying to send test webhook

[Awlexus]

Issue

Following the 2 steps of listed when trying to send a test event hook, the cli fails with the error: "you are using a legacy-style API key which is unsupported by the CLI. Please generate a new test mode API key". The webhook was defined in a sandbox environment

Expected Behavior

A test webhook being emited

Steps to reproduce

1. Install stripe cli (I used brew for the installation, both versions of the macos release cannot be executed)
2. $ stripe login
3. $ stripe trigger payment_intent.succeeded

Environment

macOs 15.3.2

$ stripe --version
stripe version 1.25.1

[tomer-stripe]

Hey @Awlexus! Could you share the merchant id for the sandbox you're using? Also does the test key (test_mode_api_key) in ~/.config/stripe/config.toml start with rk_ or sk_?

[Awlexus]

Hi @tomer-stripe, the api key starts with rk_. As for the merchant ID, I'm not sure where you find it in the dashboard. Do merchant ids start with acct_?

[tomer-stripe]

Yep! They start with acct_

edit: also do you have the entire error you're seeing by the CLI handy?

[Awlexus]

Thanks for the confirmation, the merchant id is acct_1Qzy6JE0ip1H2mD7. Unfortunately, the message from the report is the full output of the CLI

[tomer-stripe]

Hmmm so we didn't see anything unusual on our side. Few more questions:

• could you confirm that the key you're seeing on the Stripe Dashboard is the same as the key in the config file?
• is it possible there's an environment variable somewhere overriding the config?

[Awlexus]

1. Yes, the api key should be the same, the last 4 characters match
2. That's it! The project I'm working in sets the STRIPE_API_KEY variable. I'm sorry about the confusion, that was an unfortunate conflict.

Thank you for your time. Just to be sure. We received a couple of 2FA messages yesterday for no apparent reason. Could these have been caused by your testing?

[tomer-stripe]

Glad it's working!

Hmmm I don't think so. We wouldn't have logged into your account or anything. I know we have some behaviors on Stripe's side that require re-authing for anything that's super sensitive but none of the investigation for this should've triggered that.