A key pushed to GitHub, pasted in a chat, shipped in a website or left in a log is public from that moment. Bots scan public code all the time, and stolen AI keys are used within minutes. In one widely reported case, a stolen Google API key turned a three-person startup's usual $180 a month into more than $82,000 in two days. Work through these steps in order.
1. Make a new key, then revoke the old one (minutes 0 to 3)
Deleting the file or the commit does not help: copies already exist. Only the provider can stop the key.
- OpenAI: platform.openai.com, API keys. Create a new key, then delete the leaked one.
- Anthropic: the Claude Console, API keys. Create a new key, then disable or delete the leaked one.
- Stripe: Dashboard, Developers, API keys. Roll the key: Stripe makes a new one and ends the old one, now or after a short overlap.
- Google: Google Cloud console, APIs and Services, Credentials. Delete or regenerate the key.
- GitHub: Settings, Developer settings, Personal access tokens. Delete the token.
Put the new key where the app reads it (your host's secret settings), redeploy, and check that the app works before you move on.
2. See what it already cost (minutes 3 to 6)
- Open the provider's usage or billing page and look for spikes, models you never use, or traffic at hours you are asleep.
- For a payment key, look for charges, refunds and payouts you did not make. Stripe's own advice after a leak is to refund fraudulent charges quickly.
- Billing pages can lag by hours, so look again later today.
If you were charged for abuse, write to the provider's support with the dates and the time you revoked the key. Some providers refund fraud; none promise to.
3. Close the hole it leaked through (minutes 6 to 10)
- In code on GitHub: remove it, and treat every commit in the history as public. Scan the whole history so no other key is left:
npx vallkey scan --history- In a website or app: a key in browser code is readable by every visitor. Move the call to your server, or follow how to hide an API key in the frontend. Check your site with the free leak check.
- In a chat, ticket or log: delete the message if you can, and never paste a key there again: send a link to a secrets manager instead.
Make the next leak harmless
Keys leak more than ever, so plan for the next one. With Vallkey, your real key stays encrypted in Vallkey and your app gets a ghost key in its place. A ghost key only works within rules you set: the endpoints your app uses, a daily AI budget, a maximum payment, the websites and countries you allow. If one leaks, it can only do what those rules allow, and you kill it in one click without touching the real key or your other apps.
npx vallkey init # swaps the keys in your .env files for ghost keysSee how to put a spending limit on a key, or start in five minutes.