OpenAI API key leaked? Revoke and rotate in 60 seconds

1. Step 01

   Revoke the key in the OpenAI dashboard — do this first, before anything else.

2. Step 02

   Generate a new key and update your server-side env vars (Vercel, Netlify, Railway, etc.).

3. Step 03

   Scan your live URL to confirm nothing else leaked in the same deploy.

Step 01 — Revoke

Kill the leaked credential first

Sign in, find the leaked key in the list, click the trash icon. The key is dead in seconds — any in-flight requests with the old key fail. Then click "Create new secret key", give it the same name, copy the new value once (you cannot view it again).

Step 02 — Rotate

Update the new key in the right place

Server-side env vars only — never in client code, never with NEXT_PUBLIC_.

// Read OPENAI_API_KEY from env. NEVER prefix with NEXT_PUBLIC_.
const res = await fetch('https://api.openai.com/v1/chat/completions', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.OPENAI_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ model: 'gpt-4o-mini', messages }),
});

Step 03 — Scan

Confirm nothing else leaked alongside it

Scan your live site to find the rest of what leaked — bundle secrets, exposed config, public env files.

How this usually leaks

• 01Hardcoded into a frontend file by Lovable, Bolt, or Cursor when scaffolding an "AI feature".
• 02Committed to a public GitHub repo inside .env or a config file.
• 03Inlined into the JS bundle via NEXT_PUBLIC_OPENAI_API_KEY (anything NEXT_PUBLIC_ ships to the browser).
• 04Pasted into a Vercel build log that was shared in a public Discord or screenshot.
• 05Left in a Postman collection or .http file committed to source control.