Leaked OpenAI API key: what to do in the next 10 minutes

Last updated: October 24, 2026. Steps checked against OpenAI's own docs on October 24, 2026.

Short answer: Delete the leaked key on OpenAI's API keys page first. Deleted keys can't be used, so anything still using it stops working until you switch to a new key that lives only on your server.

Which OpenAI keys are secret?

Secret: OpenAI API keys (they start with sk-, for example sk-proj-)
Meant to be public: None. OpenAI says not to ship an API key in browsers or mobile apps; route requests through your own server.

The next 10 minutes

Times are a rough guide. Do the first step before anything else.

1. Delete the leaked key (Minutes 0-2)

Open the API keys page (platform.openai.com/api-keys) and delete the key with the trash can icon. OpenAI's help center: deleted keys can't be used, so apps that rely on them may stop working.
OpenAI also says that when it detects a key on the public internet or inside an app in an app store, it disables that key right away. If your AI feature already stopped working, that may be why.

2. Create a new key and keep it on the server (Minutes 2-5)

Create a new key and copy it once (OpenAI only shows the full key when you create it).
Put it in a server-only environment variable or your host's secret store, not in a VITE_ or NEXT_PUBLIC_ variable, then redeploy.

3. Check usage and cap spend (Minutes 5-8)

Look at the Usage page for activity you don't recognize and write down what you find, with times.
Set a monthly spend limit for the organization or project with hard enforcement. OpenAI notes enforcement isn't instant, so spend can go slightly over the limit, and alerts alone don't stop traffic.

4. Tell OpenAI, and secure the account if needed (Minutes 8-10)

Contact OpenAI Support by opening a chat on any Help Center page, with details of activity you didn't do.
If you think someone also had your account login, change your password, log out of all devices (Platform: Your Profile → Security) and turn on multi-factor authentication.

Good to know

Using a separate key per feature or project makes it easier to see which key was used (OpenAI supports usage tracking by key).

After the first 10 minutes

Move the code that needs the key to the server (an API route, serverless function or Supabase Edge Function), keep the key in a server-only environment variable, redeploy, and re-check your live site. The general plan, with a prompt you can paste into Lovable, Bolt, Cursor or Claude Code, is in I leaked an API key in my vibe-coded app. What do I do now?

What SniffPup checks, and what it doesn't

A free SniffPup scan reads only what your live site serves to the public: secret key patterns in HTML and same-origin JavaScript (masked in the report) and public files such as /.env and /.git/config. It never uses a key it finds. It can't see your repo, your server or OpenAI's logs, so the steps above are always on you. A clean report is not a guarantee of security.

Sources

OpenAI can change its dashboard and steps at any time. If something here doesn't match what you see, follow OpenAI's docs and tell us.

Other providers

Run a free scan →