Algolia admin API key leaked: rotate now, never use it client-side

1. Step 01

   Algolia Dashboard → API Keys → click the admin key → Reset (creates a new key, kills the old).

2. Step 02

   Update your server env vars and any indexing job credentials.

3. Step 03

   Switch any client-side search code to use a Search-only key (or Secured API Key) instead.

Step 01 — Revoke

Kill the leaked credential first

Account → API Keys → "Admin API Key" row → click "Reset". Confirm. The old key dies instantly. Never use the new admin key in browser code — generate a search-only or secured key for that.

Step 02 — Rotate

Update the new key in the right place

Server-side env vars only — never in client code, never with NEXT_PUBLIC_.

// Server (admin):
const adminClient = algoliasearch(appId, process.env.ALGOLIA_ADMIN_KEY!);

// Client (search-only — safe to ship):
const searchClient = algoliasearch(appId, process.env.NEXT_PUBLIC_ALGOLIA_SEARCH_KEY!);

Step 03 — Scan

Confirm nothing else leaked alongside it

Scan your bundle for any admin keys leaking alongside the search key.

How this usually leaks

• 01Admin key shipped to the browser instead of the search-only key.
• 02Embedded in a deployed config file.
• 03Logged to a public log endpoint.