What to do if your API key leaked
Bots scan public sites and GitHub for keys constantly, so assume a leaked key has already been copied. Work through these in order.
1. Rotate the key (right now)
Create a new key in the provider's dashboard and delete or revoke the old one. Deleting the key from your code does nothing for a copy someone already has.
2. Check what it was used for
- AI providers: look at usage and billing for spikes you don't recognize.
- Stripe: check for refunds, payouts or customers you didn't create.
- Databases: look for changed or deleted rows and unfamiliar users.
3. Put the new key somewhere safe
Keep it in server-only environment variables and call the provider from a server function. See Next.js and Vite examples.
4. Cap the damage next time
- Set a monthly spending limit or budget alert with every paid API.
- Use restricted keys with only the permissions the app needs.
- Add a rate limit to any endpoint that calls a paid API.
5. Clean up history
If the key was committed to Git, it's still in your repo history. Rotating makes the old one useless, which is what matters most.