API Key Leaked? What to Do in the Next Hour

API key leaked? Here's what to do: revoke it in the provider's dashboard and create a new one right away. Then put the new key in every app that used the old one, check your usage back to the day of the leak, and ask the provider about charges you didn't make. Finish by setting a spend limit, so the next leak costs less.

By Gary, Greenlight My App · Updated Oct 29, 2026 · How we checked this: we read OpenAI's and Anthropic's API key help pages and the Comet and TechCrunch incident reports on Oct 29, 2026. We have not walked through these dashboards with a test key yet, so the dashboard steps are untested by us. Drafted with AI tools and reviewed by a person before publishing.

What to do in the next hour (checklist)

Work through these steps in order. The first two stop the bleeding. The rest clean up and make the next leak smaller.

The minutes are our own rough plan for a solo builder with one or two apps, not a provider figure.

Why are AI API keys being stolen right now?

AI keys are valuable because anyone who holds one can run models on your bill. Two incidents this month show how keys leak from the tools that store them, not just from your own code.

• Comet (Opik), Oct 27, 2026. Comet reported (external) that an attacker used a flaw in Opik's AI provider settings to obtain 29 OpenAI and Anthropic keys. Comet says these were its own internal keys, stored in its own test workspaces, and that customer keys were not affected. All 29 were revoked.
• OpenCode Console, Oct 2026. TechCrunch reported (external) on Oct 19 that attackers broke into an older OpenCode system and affected 1.4% of OpenCode Console users, some of whom stored AI provider keys there. Users described spend alerts and unauthorized charges. OpenCode told affected users to revoke and replace their keys with each provider.

The lesson for solo builders: every tool you paste a key into is another place it can leak. Anthropic's help page says the same thing. When you give a third-party tool your key, you're giving that tool's developer access to your account.

What are the signs that my key leaked?

The clearest signs are a spend alert you didn't expect, usage at odd hours, or requests to models you don't use. A provider email saying your key was found in public is another one. Anthropic says GitHub scans public repos for Claude keys and Anthropic deactivates exposed ones.

Look for:

• Spend or usage alerts firing when you weren't working.
• Usage you don't recognise on the usage page, like a model you never call.
• A key you pasted into a tool that just announced a security incident.
• A key in a public GitHub repo, even for a few minutes.
• A key in your frontend code. Anyone can read it from the browser. See our guide to API keys (external) for why.

If any of these apply, assume the key is compromised and start the checklist.

Does deleting a key from a tool revoke it?

No. Deleting the key from a tool, your .env file or your code just stops that copy being used. Anyone who already copied the key can keep using it until you revoke it in the provider's dashboard.

This is the most common mistake. Here's what each action actually does:

OpenAI: its help page (external) says to rotate a leaked key immediately from the API Keys page and update your apps.

Anthropic: its help page (external) says to revoke the key in the Claude Console. Go to the API keys page, open the menu next to the key and choose "Delete API key."

How do I replace the key without breaking my app?

Create the new key first, put it in your host's environment settings, redeploy, then confirm the app works. If the old key is being abused, revoke it straight away and accept a few minutes of downtime instead.

A normal swap looks like this:

OPENAI_API_KEY=sk-XXXX        # new key, server-side
ANTHROPIC_API_KEY=sk-ant-XXXX # new key, server-side

Those are fake placeholders. Never paste a real key into a chat, a ticket or a screenshot.

Then:

1. Redeploy so the server picks up the new value.
2. Test one request through your app.
3. Search your projects for the old key, so no forgotten script still uses it.
4. Revoke the old key if you haven't already.

Our .env file guide (external) shows where these values should live for Vite and Next.js apps.

How do I know if my key was used?

Open the provider's usage page and look back to the day you think the key leaked. Anthropic points to the Logs and Usage pages in the Claude Console. OpenAI points to the Usage page. Compare what you see with what your app actually did.

Write down:

• The first date you see unusual usage.
• Which models were called.
• The total cost of the unusual usage.

You'll need these if you ask for a refund. Keep screenshots, but crop out any key values first.

Will OpenAI or Anthropic refund me?

There's no guarantee. Contact the provider's support with your dates and amounts. In the OpenCode incident, TechCrunch reported that OpenAI refunded API customers for credits used in the attack. That was one incident, and we found no general refund policy for leaked keys.

OpenAI's help page says to contact it through help.openai.com if you're worried about misuse. Anthropic's page doesn't describe a refund process for leaked keys, so ask its support directly. Be clear and short:

• When the key leaked, and how, if you know.
• When you revoked it.
• The dates and amount of usage you didn't make.

Don't include the key itself. Anthropic's help page says not to put your key in support tickets.

Can a spend limit stop a stolen key?

It can cap the damage, but only if it actually blocks traffic. OpenAI's help page says to set monthly spend limits with hard enforcement, and that alerts alone don't stop API traffic. Enforcement isn't instant, so spend can slightly exceed the limit.

Check your own billing page. Settings vary by account type.

A worked example, with our own numbers: if your app normally costs about $20 a month, a hard limit of $50 lets you grow without surprises. A stolen key could still burn up to about $50 before it's blocked, not hundreds.

How do I stop this happening again?

Use one key per tool and per environment, keep keys on the server, never in frontend code, and only paste keys into tools you trust. Add expiry dates where the provider supports them.

• One key per tool. If one leaks, you revoke one key, not all of them. Anthropic recommends separate keys for development, testing and production.
• Expiry dates. OpenAI says project keys can be created with an expiration date.
• Server only. OpenAI says never to deploy a key in browsers or mobile apps. Route requests through your own backend.
• Rotate on a schedule. Anthropic gives every 90 days as an example.
• Scan your repos and your live app. Our guides on Claude API key security (external) and the OpenRouter API key (external) cover the same rules for those providers.

Want to check your live app for exposed keys? Run Greenlight My App's free scan on your live URL.

FAQ

Will OpenAI or Anthropic refund me? Maybe, but nothing is guaranteed. Contact support with the dates and amounts of usage you didn't make, and don't include the key. TechCrunch reported that OpenAI refunded API customers after the OpenCode incident, but that was one case.

Does deleting a key revoke it? Only if you delete it in the provider's dashboard. Deleting it from a tool, a file or your code doesn't stop someone who already copied it. Anthropic's help page calls the dashboard action "Delete API key."

How do I know if my key was used? Check the provider's usage page, and the Logs page on Anthropic, back to the day you think it leaked. Look for models you don't use, usage at odd hours, or costs that don't match your traffic.

Can a spend limit stop it? A hard limit can cap the damage. OpenAI says alerts alone don't stop traffic, and that spend may slightly exceed the limit because enforcement isn't instant. Set both a hard limit and alerts.

Is a leaked key in a private repo safe? Not fully. OpenAI's help page notes that a data breach can leak keys from private repos too. Treat any key that left your machine as at risk, and rotate it if you're unsure.

Check your app before the next leak

Keys in frontend code are the easiest kind to steal. Run Greenlight My App's free scan on your live URL. It checks your homepage and up to five API paths it finds in your homepage and up to 15 of the scripts it loads for secret keys that shouldn't be there. The scan is automated, read-only and educational, not a security audit, and "nothing found" isn't a guarantee that nothing is exposed.