What to Do If an API Key Leaks: First 10 Minutes, First Hour, and Long-Term Prevention

If an API key appears in a public repository, screenshot, log, chat record, frontend bundle, or third-party ticket, treat it as leaked. Do not wait for abnormal balance movement; automated scripts can start consuming quota within minutes.

First 10 minutes: contain damage

• Disable or delete the suspected key immediately.
• If you are not sure which key leaked, lower limits on related keys first.
• Pause suspicious projects, scheduled jobs, agents, or CI pipelines.
• Save the leak location, time, and commit references for later investigation.

First hour: understand scope

• Review usage records around the leak time.
• Sort by key, model, time range, request volume, and cost.
• Look for unfamiliar models, abnormal volume, or off-hours calls.
• Check Git history, CI variables, deployment platforms, logging systems, and shared documents.
• If the scope is unclear, contact the Support & feedback page in the console with account email, key note, suspicious time range, and order information.

Key rotation order

• Create a new key with project, environment, and owner notes.
• Replace only backend services, CI, or server environment variables; never put the key in frontend code.
• Restart services and verify the new key with a minimal request.
• Watch usage for 10 to 30 minutes to confirm the old key is silent and the new key works.
• Delete the old key and remove the leak source from repository history or configuration systems.

What not to do

• Do not only delete the key from the latest commit while leaving it in Git history.
• Do not send the new key in group chats or screenshots.
• Do not continue sharing one new key across every project.
• Do not restart agents or scripts without limits.

Long-term prevention checklist

• Store production keys only in server-side environment variables or secret managers.
• Frontend code should call your backend, not expose model API keys directly.
• Create separate keys for projects, environments, and tools.
• Set low limits for test keys and automation jobs.
• Remove unused keys regularly and review recent usage.

FAQ

• Is a partial key leak dangerous? Usually less so, but rotate immediately if the full key appears anywhere.
• Do all keys need rotation? Not always, but expand rotation if scope is unclear.
• How can we reduce future loss? Separate keys, low limits, allowlists, usage alerts, and no frontend exposure.