Guide · 2026-10-16

How to find leaked API keys on your own website

Your source code isn't what matters here; your deployed site is. Build tools inline environment variables, so a key can be in your live JavaScript even if it's never typed in a source file.

Check it by hand

1. Open your live site in Chrome or Firefox.
2. Open DevTools and go to the Sources tab (Firefox: Debugger).
3. Press Ctrl+Shift+F (Cmd+Option+F on Mac) to search all files.
4. Search for each of these prefixes:

• sk- and sk-proj-: OpenAI
• sk-ant-: Anthropic
• sk_live_ and rk_live_: Stripe secret keys
• service_role and sb_secret_: Supabase admin keys
• AKIA: AWS access keys
• ghp_ and github_pat_: GitHub tokens
• gsk_ (Groq), xai- (xAI), r8_ (Replicate)

What's fine to find

Some keys are meant to be public: Stripe pk_ keys, Supabase anon or sb_publishable_ keys, Firebase config, and Google keys starting with AIza (as long as they're restricted to your domain).

If you find a secret

Follow what to do if your API key leaked. Start by rotating it; that's the only step that actually stops misuse.