What to do if your OpenAI API key leaked

Leaked keys get found fast. Builders regularly report bots picking up keys from public repos (see this r/OpenAI thread), and after the OpenCode key breach some users reported waking up to $1,700 bills.

1. Revoke the key now

Open the project that owns the key in the OpenAI platform, go to API keys and delete it. Create a new key for the same project.

2. Replace it everywhere

• Hosting environment variables (Vercel, Railway, Fly, etc.), CI secrets and local .env files.
• Any tool you pasted it into: AI coding assistants, automation platforms, proxies.
• Redeploy so running instances pick up the new key.

3. Clean up where it leaked

• Git: deleting the file does not delete the key from history (as builders keep reminding each other). Rotate first, then rewrite history or treat it as permanently exposed.
• Frontend: a key in browser code is public. Move calls to your server.
• Logs: redact entries and add a redaction rule for key patterns.
• Vendor breach: rotate every secret that vendor stored. For example, Railway's 21 October disclosure asked customers to rotate everything stored before that date.

4. Review usage

Check the Usage and Costs pages for the exposure window, by project. Note dates, project IDs and amounts if you need to contact OpenAI support about fraudulent use.

5. Cap the damage next time

• Give each app or agent its own project and key.
• Set a project spend limit with Enforce a hard limit turned on (see why limits sometimes “don't work”).
• Watch spend daily with an independent alert.

Prefer a checklist? Use the free leaked key response plan.