Your API key leaked: what to do first

Maybe you sent your project to GitHub with a key inside it, pasted a key into a chat, or got an email saying your key leaked. This is fixable, and there's a clear order to it. I build fline, hosting for apps people build with Claude Code, so I'll say where fline fits near the end.

What should you do first when an API key leaks?

Make a new key at the company that issued it, and turn the old one off. Then work down this list:

1. Make a new key and turn the old one off, on the issuing company's own site. Deleting the file or the message doesn't do this.
2. Put the new key where your app gets it: your host's private page for keys, not the chat and not a file in your project. Then restart your app and check that it works.
3. Check that company's usage or bill for anything since the leak that wasn't you.
4. Change the key anywhere else you used it, like a second app or a settings file on your computer.

An API key is a password your app uses to talk to another service, like payments, email or an AI model. Whoever has it can use that service as you, on your bill. So don't wait to find out whether someone did: Stripe says to replace an exposed key straight away, even if you aren't sure anyone saw it.

Turning the old key off can stop your app online from working until the new key is in place. For a key that can spend money or reach your customers' information, that pause is worth it.

Why did I get an email saying my key leaked?

If the key was in a public project on GitHub, GitHub may have found it and told the company that issued it. Anthropic says it turns off a Claude API key that GitHub finds in a public project and emails you. Stripe says that when it finds an exposed key, it asks you to replace it, and in some cases turns the key off itself.

Either way, open the company's site yourself to make the new key, rather than following a link in the email, so you know you're on the real page.

How do you replace a leaked key at OpenAI, Anthropic or Stripe?

On each company's own keys page. OpenAI and Anthropic call turning a key off "revoking" it.

• OpenAI. OpenAI's guide says to revoke a key that may have been exposed or misused, promptly, and replace it. It points to your Security settings, which list all your API keys.
• Anthropic. Anthropic recommends revoking a Claude API key immediately. On the API keys page of the Claude Console, open the menu of three dots next to the key and choose Delete API Key, then make a new key with Create Key on the same page.
• Stripe. On the API keys page of your Stripe Dashboard, open the menu next to the key and choose Rotate key. That turns the old key off and makes a replacement that's ready to use. In the Expiration list, Now deletes the old key. A later time leaves the leaked key working until then.
• Any other company. Look in its dashboard for a page called something like API keys, Developers or Security.

If the Stripe key is your publishable key, the one starting with pk_, relax: Stripe says publishable keys are safe to include in web pages and apps. The ones to replace start with sk_ (secret) or rk_ (restricted).

How do you know if someone used your leaked key?

Look at the usage or bill on the issuing company's site since the key got out, for anything you didn't do.

• OpenAI says you can watch a key's use on its Usage page, once tracking is turned on for that key.
• Anthropic recommends reviewing your keys' usage in the Claude Console, and contacting its support team if you still see activity you don't recognize.
• Stripe recommends watching request logs to spot a misused key. Each key's menu on the API keys page has View request logs.

If you find charges that weren't you, tell that company's support what you found.

Why isn't deleting the file or the commit enough?

Because copies of the key outlive what you delete. Only turning it off at the company that issued it makes every copy useless.

Your project on GitHub keeps every version you saved, each one called a commit. GitHub says that removing the key, saving a new version, or even deleting your project and making it again doesn't stop the key being used.

Cleaning it out of the history can be, in GitHub's words, destructive and disruptive, and copies other people already made of your project can still hold it. Once the old key is off, GitHub says, it can no longer be used, and that may be all you need.

The same goes for a key pasted into a chat or an email: you can delete the message, but not what someone already copied.

Where should the new key go?

On your host's private page for keys, not in the chat and not in a file in your project. Claude Code sees whatever you paste into the chat, and a file travels with your project wherever it goes, GitHub included. Is it safe to give Claude Code your API keys? covers this in more depth.

On fline, if the old key was saved there, open your project on your fline dashboard and find the key in its list of passwords and keys. Choose Replace, type the new key and save. If your app read the old key from a file, ask Claude Code to move it out:

Take the key out of my project's files so my app reads it by name, and give me fline's private page to type the new one.

Either way, once it's saved, nothing in fline shows it again, not to Claude Code and not on your dashboard. Passwords and keys your app uses has every step.

Then ask Claude Code to restart your app. On fline, a new key reaches your running app only after a restart or after it's put online again.

Restart my app on fline so it uses the new key.

Then try the feature the key is for. If it doesn't work, ask Claude Code to look at what went wrong. On fline it can read the most recent lines your app printed.

Putting an earlier version of your app back on fline won't undo the leak: it keeps the keys saved on fline as they are now, so it won't bring back a key you replaced.

How do you stop a key leaking again?

Keep live keys out of your project's files and out of the chat, and have Claude Code check before anything goes to GitHub. Ask it:

Tell me which files in this project hold keys, passwords or tokens, and whether any earlier version saved on GitHub held one. Don't print the values.

Make sure files that hold keys, like .env files, are never sent to GitHub, and that no secret key ends up in the code that runs in the visitor's browser.

What to say to Claude Code has more prompts like these.

Two more habits help. GitHub.com has a check, on by default for your own account, that stops you sending a key it detects to a public project. You can choose to send anyway, and it can't stop a key it doesn't detect, so don't lean on it alone. And where the company offers it, set a spending limit or use a key that can do less, like OpenAI's hard spend limits or Stripe's restricted keys.

Where fline fits

fline is hosting for apps you build with Claude Code on your own computer. It can't make or turn off another company's key, but it gives your app's keys a place that isn't the chat or your files.

• When your app needs a key, Claude Code gives you a link to a private fline page. You type the key there, and Claude Code sees that you did it, not what you typed.
• fline keeps a copy of each version Claude Code sends, and the version of your app it built from each one. Nothing deletes them yet, not even when you delete the project. If a key was in a file Claude Code sent, the copy fline keeps still holds it, one more reason to turn the old key off.

It's free during the private beta, with no card. Every app runs on one rented machine, with no spare and no uptime promise, and we open accounts by hand, a few at a time. What fline does today has the full list.

Built it with Claude Code, and it runs on your computer? Ask for early access.

Questions people ask

What should I do if my API key is leaked?

Go to the company that issued the key, make a new one and turn the old one off. Put the new key on your host's private page, not in the chat, and restart your app. Then check that company's usage or bill for anything you didn't do.

I accidentally pushed my API key to GitHub. Is deleting it enough?

No. GitHub keeps every version you saved, and its guide says that removing the key, saving a new version, or even deleting the project and making it again doesn't stop the key being used. Turn the old key off at the company that issued it and make a new one. Once it's off, the copy on GitHub can't be used.

What should I do if my OpenAI or Anthropic API key leaked?

Turn it off, which both companies call revoking, and make a new one. OpenAI's guide points to your Security settings, which list your API keys. At Anthropic, open the API keys page of the Claude Console, choose Delete API Key from the menu next to the key, then make a new one with Create Key. Then check that company's usage for use you didn't make.

What should I do if my Stripe secret key leaked?

Replace it straight away, even if you aren't sure anyone saw it, as Stripe says. On the API keys page of your Stripe Dashboard, open the menu next to the key, choose Rotate key and pick Now as the expiration, which deletes the old key. Then check that key's request logs for activity that wasn't you. Your publishable key, starting with pk_, is safe to show.

Will the company turn off a leaked key for me?

Sometimes, but don't count on it. Anthropic says it turns off a Claude API key that GitHub finds in a public project and emails you. Stripe says it sometimes turns off an exposed key itself, and that it can't promise to catch every one. Make a new key and turn the old one off yourself.

Can fline make me a new key, or put the old one back?

No. A new key comes only from the company that issued the old one, and fline can't turn the old one off. Putting an earlier version of your app back on fline keeps the keys saved on fline as they are now. What fline does is hold the new key: you type it on fline, not in the chat, then restart your app.