Recommended Free Tools
Assume an exposed API key is compromised: removing it from code or a repository does not disable copies that may already have been taken. Identify the issuing provider and every system using the key, then follow that provider’s rotation procedure. Where the provider allows overlapping credentials, create a restricted replacement, deploy and verify it across consumers, and revoke the exposed key promptly. Rotation rules differ by credential type, so do not promise zero downtime until you have checked the issuer’s instructions.
1. Identify the exposed key and contain the risk
Establish what credential leaked before changing it. Record the issuing provider, the key’s owner, its permissions, where it appeared, and which applications, jobs, or teams use it. Treat a production credential or a key exposed publicly as high risk. Coordinate with the credential owner and the people responsible for security and service operations; GitHub recommends prioritizing high-risk secrets and communicating with relevant teams in its repository secret remediation guidance.
As an Amazon Associate I earn from qualifying purchases.
Do not paste the secret into an incident ticket, chat, or cleanup command. Refer to it by provider, key identifier, or another safe label.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall2. Check the issuer’s rotation procedure
Rotation is not one universal operation. Find out whether the issuer permits two credentials to remain active during a transition, how to create a replacement, how to revoke the old credential, and whether the specific credential type causes a service interruption when changed.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For Google API keys, Google’s guidance describes creating a replacement, confirming its restrictions, updating applications, and deleting the previous key. See Google’s API key security best practices and Google Cloud’s instructions for responding to compromised credentials. These steps are specific to Google credentials; do not assume another provider or token type behaves the same way.
Google explicitly notes that changing an OAuth 2.0 client ID secret causes a temporary outage while the secret is rotated. That warning applies to the OAuth client secret described on that page, not to every API key.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. If overlap is supported, stage the replacement
When the provider supports more than one active credential, staged rotation can reduce downtime risk. GitHub recommends generating a new secret with the same permissions, switching the application to the new token, and then revoking the old one when downtime is a concern. Keep the overlap as short as practical: the exposed credential remains usable until revoked.
- Create a replacement: Use the provider’s console or documented API. Grant only the permissions the workload needs. Apply available restrictions, such as limiting the key to specific APIs, applications, or origins.
- Update every consumer: Change the secret in each application, deployment environment, scheduled job, and integration that uses it. Prefer a centralized secret store if that is how your workloads obtain credentials.
- Deploy and verify: Roll out the change using the application’s normal deployment process. Confirm that requests succeed with the replacement and check relevant health checks or service logs. Verify all consumers have switched rather than relying on a single successful test.
- Revoke the exposed key: Disable or delete it through the issuing provider as soon as the replacement is working everywhere that needs it.
Use GitHub’s leaked-secret remediation steps for its repository-specific guidance; the staged approach is not a guarantee that every provider supports overlap or that every rotation can avoid interruption.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
4. Revoke the old credential with its issuer
Invalidate the key at the service that issued it. Deleting a value from a source file, a commit, or a repository does not revoke credentials already copied from it. GitHub’s guidance distinguishes removing the exposed value from revoking or rotating the credential itself: remediate the repository exposure and invalidate the secret with its provider.
If the provider does not support overlap, follow its prescribed replacement or revocation sequence and plan for the documented outage behavior. Do not leave a known-compromised credential active indefinitely just to avoid a deployment change.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Investigate use and remove the exposure
After securing the credential, review whatever usage records the provider makes available for unfamiliar activity. The logs and their level of detail vary by service, so do not assume they can identify every use. Remove the secret from the exposed location and address how it got there, while avoiding another disclosure during cleanup.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →OWASP’s Secrets Management Cheat Sheet treats secure revocation of potentially compromised secrets as part of secrets lifecycle management.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Reduce the chance of another leak
- Keep secrets out of source code and use an approved secret-delivery mechanism for applications and deployment systems.
- Restrict each credential to the necessary application, API, and origin; avoid sharing one key across unrelated workloads.
- Monitor credential use and establish a process for rotating and revoking credentials when exposure is suspected.
- Consider centralized secret storage and lifecycle controls, while checking that the chosen service supports the credential type and rotation procedure you actually use. OWASP describes centralized storage, rotation, expiration, and revocation as lifecycle controls.
- Where the workload supports it, consider IAM roles, federation, or short-lived credentials instead of long-lived keys. AWS guidance discourages long-term credentials when migration to IAM roles and federated access is feasible and discusses automated credential lifecycle management: AWS security guidance on minimizing key exposure.
For Google API keys, Google also recommends keeping keys out of code, applying application and API restrictions, rotating keys, updating applications to replacements, and deleting unneeded keys in its API key best practices and compromised-credential response guidance. Google’s broader API key management best practices provide additional provider-specific guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
