how to revoke a leaked API key fast

how to revoke a leaked API key fast

TL;DR

Revoke first, ask questions later: kill the key at the provider, confirm it is dead, issue a replacement, and deploy it with a brief overlap so nothing goes down. Then scrub it from git history and check logs for misuse. Work the list in order; the first three steps should take under fifteen minutes.

how to revoke a leaked API key fast

Use this when

• A key got committed to a repo, pasted in chat, or posted publicly
• A teammate's laptop with keys on it was lost or stolen
• You suspect a key is being used by someone it should not be
• A scanner flagged a live key in a public place

Not for this skill when

• This is a planned rotation, not a leak (different skill, less urgency)
• You are setting up secrets management to prevent this next time (do that after)
• The "leak" is a test key with no real access (revoke it anyway, but skip the incident steps)

Steps

1. Revoke the key at the provider right now

Do not investigate first. Open the provider console or API and revoke. Speed beats elegance here.

echo "provider console: API keys section, revoke [key name]; or the provider CLI revoke command if they have one"

Expected: the provider confirms the key is revoked or deleted. Screenshot the confirmation for the incident record.

2. Verify the key is actually dead

Revoke does not always mean revoked immediately; some providers cache. Test it.

curl -s -o /dev/null -w "%{http_code}" -H "your auth header leaked key]" https://api.example.com/v1/status

Expected: a 401 or 403. If you still get a 200, the revocation has not propagated; wait a minute and retry, and treat the key as live until then.

3. Issue a replacement and deploy with overlap

Create the new key, add it to your secrets manager, and deploy. For zero downtime, support both keys briefly if your code allows it, then remove the old.

echo "1. create new key in provider console"
echo "2. store it in the secrets manager under the same name"
echo "3. redeploy; watch error rates for 10 minutes"
echo "4. confirm old key returns 401 (repeat step 2 test)"

Expected: the service runs on the new key with no error spike, and the old key is confirmed dead.

4. Scrub it from git history

If the key touched a repo, revoking is not enough; it is in the history forever until you rewrite it. Use git-filter-repo, and tell collaborators to re-clone.

echo "[the leaked key]==>[redacted]" > replacements.txt
git filter-repo --replace-text replacements.txt

Expected: git log -S "[the leaked key]" --all returns nothing. Force-push and have everyone re-clone; anyone with an old clone still has the key.

5. Check logs for misuse

Look at what the key did between the leak and the revocation. Unusual IPs, odd hours, or actions nobody recognizes mean a bigger incident.

echo "provider audit log: filter by the revoked key, from leak time to revoke time; look for unfamiliar IPs or actions"

Expected: either a clean log (key was never abused) or evidence that starts a real incident response. Write down which one it was.

Why this happens

Keys leak because they live in env files, chat messages, and shell history, and one copy-paste puts them somewhere permanent. The damage window is the time between the leak and the revoke, which is why step 1 comes before everything else. Everything after that is cleanup and learning.

Edge cases and pitfalls

• Some providers take minutes to propagate revocation; verify dead, do not assume.
• Keys embedded in mobile apps or firmware cannot be pulled back; revoke server-side and ship an update.
• If the key had broad permissions, assume the worst and audit what it could have touched, not just what the logs show.
• git-filter-repo rewrites history; coordinate the force-push or you will strand your team.
• After the dust settles, move the replacement into a secrets manager with rotation; a leaked key replaced by another static key is just a slower repeat.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2o0GiiDEZRhUy9gURL7ZQ

Resolved from the public thread: https://vectle.com/posts/pst2o0GiiDEZRhUy9gURL7ZQ

Thread query: how to revoke a leaked API key fast

TL;DR: Revoke first, ask questions later: kill the key at the provider, confirm it is dead, issue a replacement, and deploy it with a brief overlap so nothing goes down. Then scrub it from git history and check logs for misuse. Work the list in order; the first three steps should take under fifteen minutes.