What to do if you leaked an API key

1. Revoke or rotate the key now

Anyone who has the key can use it until the provider stops accepting it, and only revoking it does that. If the key leaked somewhere public, disable it right away and accept a short outage. If it leaked somewhere private, you can create the replacement first, deploy it, and then disable the old key.

How that looks with a few common providers:

• AWS access keys: create a new key, update everything that uses it, then deactivate and delete the old one.
• Stripe: in the Dashboard, open the API keys page under Developers and use Roll key on the secret key. You can choose when the old key stops working.
• OpenAI, Anthropic and other AI APIs: delete the key on the API keys page of the console and create a new one.
• GitHub personal access tokens: delete the token under Settings, Developer settings, Personal access tokens, and create a new one with the smallest scope that works.
• Database passwords: set a new password for the user, for example with ALTER USER app WITH PASSWORD '...'; in PostgreSQL, then update every connection string.

For AWS with the CLI, where deploy-bot is the IAM user that owns the key:

aws iam create-access-key --user-name deploy-bot
aws iam update-access-key --user-name deploy-bot --access-key-id AKIA2EXAMPLE7FAKEKEY --status Inactive
aws iam delete-access-key --user-name deploy-bot --access-key-id AKIA2EXAMPLE7FAKEKEY

Not sure which service a key belongs to? Paste the text around it into PasteSafe. For known formats the placeholder is named after the rule that matched, such as STRIPE_KEY_1, AWS_ACCESS_KEY_1 or OPENAI_API_KEY_1.

2. Check whether it was used

• Look at the provider's usage and billing pages for activity since the leak.
• Read the audit logs. On AWS, CloudTrail can list the management events of the last 90 days made with a specific key, per region.
• Look for things you did not create: new users or keys, servers in regions you do not use, changed webhooks, emails or messages you did not send.
• If the key could read customer data and there are signs it was used, bring in whoever handles security incidents at your company. There may be a duty to notify people.

aws cloudtrail lookup-events --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIA2EXAMPLE7FAKEKEY

3. Remove it from where it leaked

• A git repository: deleting the file in a new commit leaves the key in the history. See how to remove a secret from git history.
• A chat message, ticket or issue: edit or delete it, and remember that email notifications may already contain the text.
• An AI chat: delete the conversation. The provider may keep it for a while, which is one more reason the key has to be rotated.
• A log or monitoring tool: delete the affected entries if the tool allows it, and fix the code that logged the key.

How keys leak through logs

A common path is a debug log that prints a request, an SDK error that echoes the key, or a startup message that dumps the configuration. The log then gets pasted into an issue or an AI chat. Here is what PasteSafe does with such a log. Before highlights what it finds, After is its exact output:

2026-09-15T09:41:07Z DEBUG stripe: 401 Invalid API Key provided: sk_test_51FakeKeyForDocs0nlyNotReal0000
2026-09-15T09:41:08Z INFO  aws: using credentials AKIA2EXAMPLE7FAKEKEY from profile deploy
2026-09-15T09:41:08Z DEBUG GET https://api.example.com/v2/export?api_key=Qm9vbGVhbkZha2VLZXkxMjM0NTY3OA
2026-09-15T09:41:09Z DEBUG headers: {"X-Api-Key": "3f9a2c7e1b8d4f6a0c5e9b2d7a1f4c8e"}

2026-09-15T09:41:07Z DEBUG stripe: 401 Invalid API Key provided: STRIPE_KEY_1
2026-09-15T09:41:08Z INFO  aws: using credentials AWS_ACCESS_KEY_1 from profile deploy
2026-09-15T09:41:08Z DEBUG GET https://api.example.com/v2/export?api_key=SECRET_1
2026-09-15T09:41:09Z DEBUG headers: {"X-Api-Key": "SECRET_2"}

4. Make the next leak less likely

• Keep keys out of code. Load them from environment variables or a secrets manager.
• Scan before you commit. gitleaks runs as a pre-commit hook, and GitHub push protection blocks many known key formats when you push.
• Give keys the smallest permissions and, where the provider supports it, an expiry date or IP restrictions.
• Mask logs before sharing them. PasteSafe does it in your browser.

What PasteSafe cannot do

PasteSafe never contacts any service, so it cannot tell you whether a key is valid, whether it was used, or revoke it for you. It also misses keys in formats it has no rule for when they sit under a neutral name and do not look random. The fix for a leaked key is always in the provider's own console.