OpenAI API key leaked: what to do now

By Shinobi Tech, the team behind AppLeakWatch. Updated .

Delete the key in your OpenAI dashboard now, create a new one, and check your usage for anything you don't recognize. The same steps apply to Anthropic, Groq and other AI provider keys. Then move AI calls behind your own server.

Why this happens

If your front end calls an AI provider directly, every visitor receives your key. Someone can copy it and spend your money on their own requests.

How to check

  1. Search your built files:
    grep -rE "sk-(proj|ant)-" dist/ build/ .next/static/
  2. Open your site's Network tab in dev tools. Requests going straight to an AI provider are a warning sign.
  3. Review usage by day and by key in your provider's dashboard.

How to fix it

  1. Delete the leaked key and create a new one.
  2. Set spending limits in your provider's dashboard.
  3. Create a server route that calls the AI provider.
  4. Add a login check and a rate limit to that route, otherwise strangers can still spend your money through it.

Prompt for your AI tool

Move all AI provider calls out of front-end code into a server route. Read the API key from a server environment variable, require a signed-in user, add a per-user rate limit, and show me what changed.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Will the provider refund misuse?

That's up to the provider. Report it to their support quickly and keep your evidence.

Is a .env file enough to protect my key?

Only for server code. Values built into the front end still reach the browser.

Related guides