Monitor & Revoke Leaked API Keys Before Abuse

Leaked API keys are a top cause of unauthorized cloud bills, data breaches, and account takeovers. This guide shows you how to continuously monitor for exposed keys—across code repositories, public logs, and third-party scanners—and how to revoke them quickly before they are abused. You will learn practical detection methods, step-by-step revocation procedures for major platforms, and how to automate the process to minimize your exposure window.

What You’ll Need

• Access to the cloud provider or service where the API key was issued (e.g., AWS, Google Cloud, GitHub, Stripe).
• Admin or owner permissions on that account to create and revoke keys.
• GitHub account (free tier is fine) for repository scanning.
• Optional: a Slack or email webhook for automated alerts.
• Basic familiarity with command line and environment variables.

Step-by-Step

1. Identify All Active Keys

Before you can monitor, you need an inventory. Log into each service you use and list every API key, service account, and access token. In AWS, use IAM > Users > Security credentials. In Google Cloud, go to IAM & Admin > Service Accounts. In GitHub, check Settings > Developer settings > Personal access tokens. Record the key name, creation date, and last used date. This will help you spot anomalies later.

2. Set Up a Secret Scanning Tool

You need automated detection. The most effective free option is GitHub Secret Scanning—it automatically scans public repositories for known key patterns (AWS, Google, Stripe, etc.) and alerts you. Enable it by going to your repository Settings > Security > Secret scanning. For private repos, you can use Gitleaks or TruffleHog as pre-commit hooks or in CI pipelines. These tools scan for high-entropy strings and known key formats.

3. Scan Your Code Repositories

Run a one-time scan of all your repositories (public and private) using a tool like Gitleaks. Install it locally and run gitleaks detect --source /path/to/repo. For GitHub, you can also use the GitHub Security tab to see any exposed secrets that GitHub has already detected. For private repos, use the API or a CI job that fails if a secret is found.

4. Monitor Public Logs and Paste Sites

Keys often leak through error logs, debug outputs, or public gists. Set up a free account on Have I Been Pwned? No—that’s for passwords. Instead, use Google Alerts with queries like your key prefix or domain. Also monitor GitHub Search for your key patterns (e.g., “AKIA” for AWS). For more thorough coverage, consider a paid service like GitGuardian or Vaulted that monitors public code, paste sites, and dark web forums.

5. Automate Alerts

Don’t rely on manual checks. Use webhooks to send alerts to Slack or email. For GitHub Secret Scanning, configure the alert to notify your security channel. For Gitleaks in CI, set it to fail the build and notify. For cloud providers, enable CloudTrail (AWS) or Audit Logs (Google) to log key usage, and set up CloudWatch alarms for unusual activity like a key calling from a new region.

6. Establish a Revocation Protocol

When a leak is detected, time is critical. Prepare a runbook that includes:

• Immediate revocation of the key (steps below).
• Rotating the key (create a new one and update your applications).
• Auditing what the key had access to and checking for unauthorized actions.
• Notifying affected users if the key was used to access personal data.

7. Revoke the Key on the Provider Platform

Revocation methods vary by provider:

• AWS: Go to IAM > Users > select the user > Security credentials > find the access key > click “Make inactive” or “Delete”. For root keys, go to My Security Credentials and deactivate. Note: you cannot delete the root key, but you can deactivate it.
• Google Cloud: IAM & Admin > Service Accounts > select the account > Keys > click the trash icon to delete the key.
• GitHub: Settings > Developer settings > Personal access tokens > click the token > Delete. For OAuth apps, revoke the token in the app settings.
• Stripe: Dashboard > Developers > API keys > click “Deactivate” on the secret key.

8. Rotate the Key

After revoking, create a new key with the same permissions (if appropriate) and update your applications immediately. Use environment variables or a secrets manager (like AWS Secrets Manager, Google Secret Manager) to store the new key. Never hardcode keys in code or configuration files.

9. Verify the Revocation

Wait a few minutes and test the old key. Try to make an API call with it. It should fail with an authentication error. Also check the provider’s activity logs to ensure no further calls were made after revocation. If you see calls after the revocation time, you may have missed a secondary key or the revocation didn’t propagate.

10. Document and Improve

After the incident, write a post-mortem. What caused the leak? How was it detected? How long did it take to revoke? Update your scanning tools and protocols to catch similar issues faster. Consider implementing short-lived keys or using IAM roles with temporary credentials instead of long-lived keys.

Common Mistakes

• Only scanning public repos—private repos and internal code are common leak points.
• Revoking but not rotating—if you only delete the key, you lose access; you must create a new one and update your apps.
• Not checking for other copies—the same key may be in multiple places (e.g., a CI config and a backup).
• Ignoring inactive keys—even unused keys can be abused if leaked.
• Delaying revocation to avoid downtime—the cost of abuse far outweighs a few minutes of downtime.

Tips

• Use short-lived keys (e.g., AWS STS temporary credentials) that expire automatically.
• Implement a “least privilege” policy—give each key only the permissions it needs.
• Set up a dedicated security email or Slack channel for alerts.
• Regularly audit your keys (at least quarterly) and remove unused ones.
• Use a secrets manager to centralize key storage and rotation.

Troubleshooting

I found a key but I’m not sure if it’s still active

Check the provider’s console for the key’s “last used” date. If it shows recent activity, assume it’s active and revoke immediately. If it hasn’t been used in months, still revoke—it’s a risk.

Revocation didn’t stop the abuse

First, verify the key was actually deleted (not just deactivated—some providers allow deactivated keys to be reactivated). If abuse continues, you may have another key with similar permissions. Check all keys under the same user/service account. Also check if the key is a “root” key that cannot be deleted—deactivate it and rotate your access keys.

GitHub Secret Scanning isn’t detecting my key

Secret scanning only works for known patterns. If your key is custom (e.g., a random string), use Gitleaks with a custom regex. Also ensure you have enabled secret scanning for all repositories (it may be off by default for private repos).

I can’t find where the key is used

Search your codebase for the key ID or a prefix. Use grep -r "key_prefix" .. Also check environment variables on your servers and CI platforms. If you still can’t find it, revoke it anyway—it may be in a third-party service.

Frequently Asked Questions

How often should I scan for leaked keys?

At minimum, run a scan weekly. For high-risk projects, set up automated scanning on every commit via CI/CD. Continuous monitoring with alerts is ideal.

Can I revoke a key without deleting it?

Yes, most providers allow you to deactivate a key temporarily. This is useful for testing if the key is the source of abuse. However, deactivation is not a permanent fix—delete the key after confirming.

What should I do if the leaked key had access to sensitive data?

Revoke the key immediately, then review the provider’s audit logs to see what data was accessed. If personal data was exposed, you may need to notify affected users and follow your organization’s breach response plan.

Are free scanning tools enough?

For small projects, yes. GitHub Secret Scanning and Gitleaks cover most cases. For larger organizations, consider paid tools that monitor more sources (paste sites, dark web) and offer better alerting.

How do I prevent future leaks?

Use environment variables and secrets managers. Never hardcode keys. Implement pre-commit hooks to block secrets from being committed. Educate your team on secure coding practices.

What if the leak came from a third-party service?

Revoke the key and remove it from that service. Contact the third-party provider to understand how the leak occurred. Review your integrations and consider using OAuth tokens with limited scopes instead of API keys.

Related

• Party Games: Why Everyone Should Try Them
• 5 Retro Gadgets That Still Just Work Today
• Thunderbird Connected Services: Status & Future