Free tool

Leaked an AI API key? Do this, in this order.

Pick the provider and where it leaked. You get a step-by-step plan you can print. No sign-up, and never paste the key itself anywhere.

Which provider's key?

Where did it leak?

Your response plan: OpenAI, committed to a git repo (public or private)

Revoke the key now. In the OpenAI platform, open the project that owns the key → API keys → delete the leaked key (project keys can't be paused). Create a new key for the same project.
Replace it everywhere it is used (env vars in your host, CI secrets, local .env files), then redeploy.
Assume it was scraped within minutes if the repo is public. Rotate first, clean up second.
Deleting the file does not remove the key from git history: rewrite history (e.g. git filter-repo) or treat the repo history as permanently exposed.
Turn on secret scanning / push protection for the repo.
Review usage. Check the Usage and Costs pages for the last few days, filtered by project, for traffic you don't recognise.
Contain future damage. Set (or lower) a project spend limit and turn on “Enforce a hard limit”.
If you see fraudulent charges, contact the provider's support with the dates and key/project IDs.
Add a server-side spend watcher with daily thresholds so the next one is caught early.