If an API key is exposed, treat it as compromised: revoke or delete it promptly, issue a replacement, update every authorized system that used the old key, and inspect account activity for anything unexpected. Do not assume a short exposure was harmless or that a provider automatically disabled the key.
1. Revoke the exposed key
Use the provider’s credential controls to invalidate the exposed key. Prioritize stopping its use, while accounting for production services that may depend on it. Follow the provider’s own rotation instructions where available.
As an Amazon Associate I earn from qualifying purchases.
For OpenAI, the Help Center advises users who believe a key has leaked to rotate it immediately from the API Keys page. Its account-security guidance says to delete the affected key through the API key dashboard when compromise is suspected. OpenAI’s API key safety guidance and account security guidance describe those steps.
OpenAI says it disables keys it detects on the public internet or in an app-store app. That is specific to OpenAI’s detection; it is not a reason to wait, and it says nothing about how another provider handles exposed keys.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Replace the key everywhere it was used
Create a new key, then update each authorized application and secret store that depended on the exposed value. Common places to check include:
- Application and deployment environment variables
- CI/CD systems and automation scripts
- Secret stores and configuration services
- Other authorized services or environments that call the API
Test the integration using the replacement, then confirm the revoked key is no longer required. GitHub’s general guidance for leaked credentials likewise calls for generating a replacement, replacing the old credential everywhere it is stored or accessed, and deleting the compromised credential. See GitHub’s credential security guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not put the replacement in source code, a ticket, chat message, or log. Removing the old value from the latest version of a source file is not enough if it remains in a deployment setting, automation system, or another authorized store.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →3. Check usage and retain useful evidence
Review the provider’s usage or activity records for requests, timing, or volume that do not fit your expected workload. Preserve relevant time ranges, usage entries, alerts, and where the key was exposed. Keep the records private: do not copy or redistribute the secret itself.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
OpenAI advises users who suspect compromise to review API usage, keep details, and contact Support. The exact usage views and available records vary by provider; the guidance reviewed here does not establish universal log-retention periods or a standard forensic procedure.
4. Contact the provider if activity is unauthorized
Escalate to provider support if you find activity you did not authorize, cannot revoke the key, or see other suspicious account activity. If the key may have been exposed through a broader system incident, investigate whether other credentials or systems were accessible too. There is no single provider-independent recovery process established here, so follow the affected provider’s account-security instructions.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Reduce the chance and impact of another exposure
Keep keys out of client-side code
Do not embed API credentials in browser or mobile application code, where users may be able to extract them. Route requests through a backend that can keep the credential server-side.
Limit scope and access
Use separate credentials for distinct projects or workloads where practical, and restrict each key to the APIs and permissions it needs. Google Cloud recommends restricting API keys to only the APIs that require them and discusses key restrictions, rotation, usage monitoring, and stronger alternatives such as IAM policies and short-lived service-account credentials where applicable. See Google Cloud’s API key management guidance.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Store, rotate, and monitor credentials deliberately
Keep keys in controlled secret storage and limit who or what can read them. GitHub identifies 1Password and Azure Key Vault as examples of secure credential storage, and GitHub Actions secrets as an option for scripts. Use expiration or rotation policies if the provider and your deployment support them. Monitor usage and configure spend thresholds where available; a spend limit may help manage exposure, but enforcement may not be instantaneous.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
