API Key Exposed? Revoke, Rotate, and Check Usage

If your API key is exposed, the immediate answer is to revoke it, rotate it, and then check usage logs for any unauthorized activity. This article explains exactly why each step matters, how to do them across common platforms, and how to prevent future leaks.

Why an Exposed API Key Is Dangerous

An API key is a credential that lets a program identify itself to a service. If someone else gets that key, they can impersonate your application. Depending on the service, that might mean they can read your data, spend your quota, or even modify resources. The danger is real because API keys are often used in URLs, mobile apps, or committed to public code repositories by accident. Even a key with limited permissions can be abused to rack up large bills or exfiltrate sensitive information.

Immediate Steps: Revoke, Rotate, and Check Usage

The moment you discover a leak, follow these steps in order:

Revoke the exposed key. Go to the service’s dashboard (e.g., Google Cloud Console, AWS IAM, Stripe Dashboard) and delete or disable the key. This stops any further use immediately.
Rotate the key. Create a new key with the same permissions and update your application to use it. This is not optional—revoking without rotating leaves your app broken.
Check usage logs. Look at the service’s activity logs or billing dashboard for the time period when the key was exposed. Look for unusual API calls, new IP addresses, or unexpected geographic locations.

If you find suspicious activity, note the IPs and timestamps—they can help you understand what was accessed. In many cases, you can also set up alerts for future anomalies.

How to Revoke and Rotate on Common Platforms

The exact steps vary by provider, but the pattern is similar. Here are examples for three major services:

Google Cloud Platform: In the Cloud Console, go to APIs & Services → Credentials. Find the API key, click the trash icon to delete it. Then click “Create Credentials” → “API key” to make a new one. Update your code and environment variables.
AWS: If you’re using an access key (like for IAM users), go to IAM → Users → select the user → Security credentials. Deactivate the old key, then create a new one. Update your application’s credentials file or secrets manager.
Stripe: In the Dashboard, go to Developers → API keys. Click “Roll key” for the secret key. This automatically revokes the old key and gives you a new one. Then update your server environment.

Always check if your service offers a “roll” or “rotate” button—it often does both steps at once.

How to Check Usage Logs Effectively

Usage logs are your forensic tool. Here’s what to look for:

IP addresses: If you see requests from countries or ISPs you don’t use, that’s a red flag.
Request volume: A sudden spike in calls could indicate automated abuse.
Endpoints accessed: If the key was for a storage service, check if files were downloaded or deleted.

Most cloud providers have a logging feature. For example, Google Cloud’s Cloud Logging can filter by API key. AWS CloudTrail logs API calls. Stripe’s dashboard shows recent requests. If logging was not enabled before the leak, you may not have data—that’s a lesson to enable it now.

Preventing Future Leaks

Once you’ve cleaned up, take these steps to reduce the risk of another leak:

Use environment variables or a secrets manager (like AWS Secrets Manager or HashiCorp Vault) instead of hardcoding keys.
Add a .gitignore entry for your .env files, and scan your repo history for keys.
Restrict key permissions to only what’s needed. Don’t give a key full admin access if it only needs to read.
Set up alerts for unusual activity, like a sudden spike in usage or a new IP.
Rotate keys regularly—even without a leak, rotating every 90 days is a good practice.

Common Mistakes When Handling Exposed Keys

People often make these errors:

Only rotating, not revoking: If you don’t revoke the old key, it still works. Rotating usually replaces it, but make sure the old one is dead.
Forgetting to update all environments: If your key is used in staging and production, update both. A common mistake is updating only one.
Ignoring usage logs: Some people skip this step, but it’s crucial to know what was accessed. You might need to notify users or audit security.
Assuming a key with no permissions is safe: Even a read-only key can leak data. Always revoke.

Frequently Asked Questions

How do I know if my API key has been exposed?

You might get an alert from a service like GitHub (which scans for keys), or you might see unexpected usage in your logs. If you accidentally committed a key to a public repo, assume it’s compromised.

Can I just deactivate the key instead of deleting it?

Yes, deactivating is often enough to stop usage, but you should still rotate it. A deactivated key can be re-enabled, so deleting is safer if you’re sure you don’t need it.

What if the key was in an old commit?

You need to rotate the key, because even if you remove it from the latest commit, it’s still in the history. Anyone can find it.

How long does it take for a revoked key to stop working?

Usually immediately, but some services have a short delay (a few minutes). Check the service’s documentation.

Should I change my password too?

Only if the API key was tied to your account in a way that could expose other credentials. Generally, changing the key is enough, but if you suspect broader compromise, change your password and enable 2FA.

What if I can’t find the usage logs?

If logging wasn’t enabled, you may not be able to see past usage. In that case, focus on revoking and rotating, and enable logging going forward.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →