I leaked an API key. Here's exactly what to do

If you leaked an API key, revoke it right now at the provider, then make a new one, update your apps, and check the account for anything you didn't do. Deleting the key from your code is not enough, because copies live on in history, forks and screenshots. The key is only safe once the provider says it's dead.

Take a breath. This happens to a lot of people, and the fix is mostly clicking buttons in the right order. Here's the order, plus the official instructions for the five services people leak most.

Why is a leaked API key such a big deal?

An API key is a password for software. Whoever holds it can use your account, and you get the bill. With AI services, that can mean someone running up big charges on your card. With payment or cloud keys, it can mean much worse.

And leaks are common. Security company GitGuardian counted 28.6 million new secrets pushed to public GitHub code in 2025, up 34% in a year, and keys for AI services rose 81%. Source: GitGuardian, State of Secrets Sprawl 2026.

Here's the part that matters for you: the same report found that 64% of keys leaked back in 2022 still worked in January 2026. People removed the key from their code and assumed they were done. They weren't. More numbers like this live on our stats page.

Is deleting the key from my code enough?

No. This is the single most common mistake.

When you delete a key and push a new version, the old version is still in your project history. Anyone who copied or forked your project has it. Bots scan public code constantly, so assume someone grabbed it within minutes. GitHub's own guide says it plainly: simply removing the secret from the code doesn't stop someone from using it. Source: GitHub Docs, Remediating a leaked secret.

The only real fix is to make the key stop working.

What should I do first when an API key leaks?

Same steps for every provider:

1. Revoke the key (also called delete, expire, deactivate or rotate, depending on the service).
2. Create a replacement key.
3. Update every place that used the old key: your app, your server settings, your automated build tools, your teammates' setups.
4. Check the account's usage and logs for activity you don't recognize, going back to when the key first leaked.
5. Contact the provider's support if you see charges or activity that isn't yours.
6. Clean up the leak so it doesn't happen again (more below).

If you're worried about breaking your live app, it's fine to make the new key first and swap it in quickly. But don't let "I'll do it tomorrow" happen. A leaked key that still works is an open door.

How do I revoke a leaked OpenAI API key?

Go to your OpenAI API key settings, delete the exposed key, create a new one and update your apps. Then check your usage page for anything strange and contact OpenAI support if something looks wrong. OpenAI also lets you set spending limits, which turns a future leak into an annoyance instead of a disaster.

Official guide: OpenAI, Best practices for API key safety and Keeping your OpenAI account secure.

How do I revoke a leaked Anthropic (Claude) API key?

Anthropic recommends revoking a possibly exposed key immediately. Sign in to the Claude Console, open the API keys page, click the three-dot menu next to the key and choose Delete API key. Then create a new one.

Small bit of good news: Anthropic partners with GitHub, so if a Claude API key shows up in a public GitHub repository, Anthropic is notified and automatically deactivates it. Don't count on that, though. Keys leak in lots of places that aren't GitHub.

Official guide: Anthropic, API key best practices.

How do I rotate a leaked Stripe secret key?

Stripe keys can move real money, so move fast. In the Stripe Dashboard, open API keys, click the menu next to the key and choose Rotate key. If the key was leaked, set the old key to expire Now instead of using the grace period. Stripe lets old and new keys both work for up to 7 days during a normal rotation, which is handy for planned changes but not what you want after a leak.

Then check the key's request logs for anything you didn't do. Going forward, Stripe recommends "restricted" keys that only have the permissions your app needs.

Official guide: Stripe Docs, API keys (Rotate an API key).

How do I deactivate a leaked AWS access key?

In the AWS console, open IAM, choose Users, pick the user, open the Security credentials tab and find the access key. Create a new key, update your apps, then choose Actions → Deactivate on the old one, and finally Delete it. After a leak, deactivate the old key right away rather than waiting days like the normal rotation guide suggests.

Then review AWS CloudTrail (AWS's activity log) for actions you didn't take, like new servers or new users. Attackers love spinning up expensive machines on stolen keys.

Official guides: AWS, Update access keys and AWS, Manage access keys for IAM users.

What if the key leaked on GitHub?

GitHub's guide walks through the whole cleanup: figure out what the secret is and who owns it, revoke it with the provider, update every service that used it, check audit logs for misuse, consider removing it from your project history, and turn on push protection so GitHub blocks the next leak before it happens.

Official guide: GitHub Docs, Remediating a leaked secret in your repository.

Rewriting history is optional and a bit of a hassle. Revoking is not optional.

Where else do API keys leak?

Code is just the most famous spot. Keys also leak through:

• Website code. Keys put in the parts of a site that run in visitors' browsers can be read by anyone. Our free Leaked Key Check scans your page, its same-site scripts and public "source map" files for secret keys. It masks what it finds and never stores it.
• AI-tool setup files. GitGuardian found 2,117 still-working keys in public setup files for AI agent tools (called MCP configs), often because the setup guides tell you to paste keys right in. See Are MCP servers safe? for more.
• Screenshots, chats and shared docs. If you pasted it into a team chat or a ticket, treat it as leaked.

Your five-minute fix

1. Revoke the leaked key now using the provider links above. Don't wait until you've found every place it's used.
2. Make a new key and swap it in, keeping it in an environment variable or a secrets manager, never in your code.
3. Check usage and logs for the time since the leak, and call support about anything that isn't yours.
4. Set spending limits or restricted permissions so the next leak costs less.
5. Scan your website with the Leaked Key Check to make sure no other keys are showing.