Guide · Security
What Happens If Your API Key Is Leaked?
A leaked API key can cost you thousands and expose your data. Here's what happens and what to do immediately.
Leaked credentials are an incident—revoke, rotate, and prove containment. Primary control: Secrets Management
Assume the key is already being used
Once a key hits frontend bundles, git history, logs, or a searchable doc, scrapers often find it within hours. Spend spikes, strange traffic, or data access follow. A contractor dropped a staging Anthropic key into a shared Notion page for a demo; public search indexed it; strangers were completing against it within a day.
Revoke first, investigate second
1. Revoke in the provider console; mint a replacement only after you know where the old one lived.
2. Scrub the source: frontend, repo history, CI logs, tickets, screenshots.
3. Move all calls behind a backend so browsers never see secrets again.
4. Turn on billing alerts, rate limits, and usage anomaly watches.
5. Add pre-commit / git-secrets (or equivalent) so the next paste fails locally.
Standing playbook after that incident: revoke-first, Secrets Manager for replacements, scan docs for `sk-` patterns.
Secrets custody is the lasting fix
APRF Secrets Management and Authentication care that credentials aren't client-side and that rotation is practiced. A leaked key is an incident; leaving keys in the browser is a design failure.
Next: Secrets Management
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.
Related
Frequently asked questions
- What happens when an API key is leaked?
- Bots scrape leaked keys within hours. Attackers use them to rack up bills, abuse your API, or access data. Rotate the key immediately and move all API calls to a backend.
- How do I remove a leaked API key from git history?
- Use BFG Repo-Cleaner or git-filter-repo to remove the key from history. Then rotate the key—the old one is compromised even if removed from the repo.
- How do I prevent API key leaks?
- Never put keys in frontend code. Use a backend proxy. Store keys in a secrets manager. Use git-secrets to prevent committing secrets. Set up billing alerts.