← BlogKey leaked3 min readUpdated 2026-08-03

OpenAI API key leaked: what to do right now

Rotate first, investigate second. Here is the order that limits the damage.

1. Rotate it now

Revoke and reissue in the OpenAI platform

  1. 1Open platform.openai.com/api-keys and sign in.
  2. 2Find the exposed key in the list and click Revoke. It stops working immediately.
  3. 3Create a new key and store it somewhere only your server can read.
  4. 4While you are there, set a monthly usage limit under Settings → Limits — this caps the damage of any future leak.

Console: https://platform.openai.com/api-keys

2. What someone can do with it

  • Anyone can call the API and bill it to your account, at your rate limits, until your card declines or your limit is hit.
  • Keys scraped from public code are used within minutes, not days — automated scanners watch public repositories and deployed bundles continuously.
  • The usual pattern is heavy use of your most expensive model, resold to other people.

3. Check whether it was already used

Look for activity you did not cause

  1. 1Open platform.openai.com/usage and look at the last 7 days.
  2. 2Compare the daily pattern against what your app actually does — a spike on a day you shipped nothing is the signal.
  3. 3Check which models were used. Calls to a model your app never uses mean someone else was spending.
  4. 4If you see unfamiliar usage, contact OpenAI support with the dates — billing disputes are much easier with specifics.

4. Find out how it leaked

Almost always one of three things: the key was called directly from frontend JavaScript, it was put in a variable with a client-exposed prefix (VITE_, NEXT_PUBLIC_, REACT_APP_), or it was committed to a repository that later went public. The prompt below finds all three.

Paste this into Cursor, Claude Code or your builder
Find every hardcoded credential in this project and move it out of the code.

1. Search all files — including client code, config files, and anything
   already committed — for hardcoded secrets: OpenAI keys, plus
   any string starting sk-, sk_live_, AKIA, ghp_, or variables named
   *_SECRET, *_TOKEN, *_API_KEY.
2. For each one, tell me the file, the line, and whether that code runs in
   the browser or on the server.
3. Move every real secret to a server-only environment variable. Do NOT
   use a client-exposed prefix (VITE_, NEXT_PUBLIC_, REACT_APP_) — those
   are compiled into the browser bundle.
4. Any provider call that needs the secret must happen server-side; change
   the frontend to call my own endpoint instead of the provider directly.
5. Check whether the secret is in git history, not just the current files.
   If it is, say so — removing it from HEAD does not remove it from history.

Give me a list of every secret found, where it was, and what you changed.

This is one check out of 40+

Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.

Check my site — free