Leaked an API key? › ElevenLabs
Leaked ElevenLabs API key (unauthorized charges): what to do in the next 10 minutes
Last updated: November 5, 2026. Steps checked against ElevenLabs's own docs on November 5, 2026.
Short answer: Delete or disable the leaked key in your ElevenLabs dashboard or Workspace Service Accounts first. Then create a new server-only key with a credit quota, check usage for activity you didn't do, and email ElevenLabs Support from your account email about unauthorized usage or charges.
Which ElevenLabs keys are secret?
- Secret: ElevenLabs API keys (passed in the xi-api-key header or created in your dashboard or workspace)
- Meant to be public: None. ElevenLabs says never to expose API keys in client-side or browser code; route all requests through your own server.
The next 10 minutes
Times are a rough guide. Do the first step before anything else.
1. Delete or disable the leaked key (Minutes 0-2)
- In ElevenLabs, open your personal API keys (or Workspace → Service Accounts if the key belongs to a service account) and delete or disable the exposed key so it stops working.
- If you cannot reach the dashboard right away but can call the API, you can self-disable the key using ElevenLabs' Disable API key endpoint with api_key_name=self.
- If the key was pushed publicly to GitHub, ElevenLabs is a GitHub secret scanning partner and may have already auto-disabled the key (with disable reason exposed_publicly if third-party disable is allowed). Do not rely on this alone; verify in your dashboard.
2. Create a restricted replacement key on your server (Minutes 2-5)
- Create a replacement key under the same workspace or service account. ElevenLabs recommends service accounts for production backends rather than personal user keys.
- Restrict the replacement key: select only the scopes your app requires, set a credit quota to cap usage, and configure IP allowlisting (1–100 public IPs or CIDR ranges; private ranges are rejected and requests from other IPs get a 403) if your backend has stable egress IPs.
- Store the key only in your server environment variables or hosting secret manager—never in client-side code, HTML, or VITE_ or NEXT_PUBLIC_ variables—and redeploy your application.
3. Review usage and tighten billing limits (Minutes 5-8)
- Check your ElevenLabs dashboard usage history for text-to-speech or voice generations you did not make, and note the timestamps and request IDs of unauthorized activity.
- Review your subscription and billing settings: tighten or disable Pay As You Go (or the max credits threshold for legacy usage-based billing) to prevent unexpected overage charges while you investigate.
4. Contact ElevenLabs Support and clean up (Minutes 8-10)
- Email support@elevenlabs.io directly from your account's registered email address. Report the unauthorized access, explain that the key was exposed, and include the affected timestamps and request IDs. ElevenLabs' published refund eligibility is within 14 days of payment and only when no credit quota has been used, which may not cover usage someone else ran up on your key, so ask support directly about the unauthorized usage and charges.
- Rotate any other API keys, database credentials, or environment secrets that were stored alongside the leaked key in the same file or commit.
- Remove the exposed key from your git history, frontend code, and public files, and re-check your live site.
Good to know
- ElevenLabs is an official GitHub secret scanning partner; publicly exposed keys can be automatically disabled if third-party disable is permitted on the key.
- Service account keys are recommended for backend services because they are not tied to one team member's account and do not expire. User API keys can be set to expire (15 minutes to 30 days).
- Setting a credit quota on each API key helps limit financial risk if a key is ever compromised.
After the first 10 minutes
Move the code that needs the key to the server (an API route, serverless function or Supabase Edge Function), keep the key in a server-only environment variable, redeploy, and re-check your live site. The general plan, with a prompt you can paste into Lovable, Bolt, Cursor or Claude Code, is in I leaked an API key in my vibe-coded app. What do I do now?
What SniffPup checks, and what it doesn't
A free SniffPup scan reads only what your live site serves to the public: secret key patterns in HTML and same-origin JavaScript (masked in the report) and public files such as /.env and /.git/config. It never uses a key it finds. It can't see your repo, your server or ElevenLabs's logs, so the steps above are always on you. A clean report is not a guarantee of security.
Sources
- ElevenLabs Docs: API keys (workspaces, restrictions, rotation, self-disable)
- ElevenLabs Docs: Billing, credits and Pay As You Go
- ElevenLabs Help Center: How can I contact support?
- ElevenLabs API Terms (revoke exposed credentials, notify ElevenLabs of unauthorized access)
ElevenLabs can change its dashboard and steps at any time. If something here doesn't match what you see, follow ElevenLabs's docs and tell us.
Other providers
- Leaked OpenAI API key: what to do in the next 10 minutes
- Leaked Stripe secret key: what to do in the next 10 minutes
- Leaked Supabase service_role or secret key: what to do in the next 10 minutes
- Leaked AWS access key: what to do in the next 10 minutes
- Leaked GitHub token: what to do in the next 10 minutes