diff --git a/conservancy/supporters/views.py b/conservancy/supporters/views.py
index 6178cd05..794abdf2 100644
--- a/conservancy/supporters/views.py
+++ b/conservancy/supporters/views.py
@@ -195,6 +195,9 @@ def sustainers_stripe(request):
     return render(request, 'supporters/sustainers_stripe.html', {'form': form})
 
 
+# Use a "restricted" API key and grant access to:
+# - checkout sessions (write)
+# - credit notes (read) - unclear why, subscription sign-ups fail otherwise
 stripe.api_key = settings.STRIPE_API_KEY
 if stripe.api_key == '':
     logger.warning('Missing STRIPE_API_KEY')