API key leaked: revoke first, investigate second

A concrete checklist for a leaked relay or provider API key, including billing checks and safe rotation.

Reviewed 2026-11-12 · Chinese detail: 完整中文页

Treat it as compromised immediately

A key pasted into a public repository, a screenshot, a chat, or a client-side bundle must be considered public. Revoke it in the provider dashboard before doing anything else. Creating a second key first does not help; the old key stays valid until it is deleted.

Rotate and verify

1. Revoke the exposed key.

2. Create a new key with the same or narrower permissions.

3. Deploy the new key through an environment variable or secret manager, never in source code.

4. Check usage and billing for the period the key was exposed. Look for models or regions you never call.

5. Search repositories, CI logs, and issue trackers for the key prefix. Removing the file is not enough if the value remains in git history.

If the key belongs to a relay

Relay keys are usually scoped to that site's balance. Revoke the key in the relay dashboard and ask support whether the account shows unusual usage. A relay cannot always tell you which upstream key was used, so rotate anything else that shared the same secret.

Prevent the next leak

Use separate keys per environment and per service, set spending limits where the provider supports them, and add a secret scanner to CI. Never paste a full key into a support ticket; the last six characters are enough to identify it.

This page is general guidance, not a statement about any specific provider. For measured data, see the relay directory and method.