sk-…
Exposed OpenAI API Key? Here's how to detect and rotate it
A leaked OpenAI key (sk-…) racks up API charges on your account. Scan free with Trust, then delete the key at platform.openai.com/api-keys in seconds.
An OpenAI API key (starting with sk-) authenticates requests to the OpenAI API and bills them to your account. Anyone with the key can call the models on your dime until you revoke it. Keys can't be viewed again after creation, so a leak means you must replace it.
What an attacker can do with a leaked OpenAI API Key
- Runs up your API bill by hammering expensive models until your credits or limits are exhausted.
- Burns through your rate limits, degrading or breaking your own app's access.
- Reads project/org details visible to the key and enumerates your models.
- Resells access to your key on gray-market ‘GPT proxy’ services.
How OpenAI API Keys get exposed
- Committed to a public repo — OpenAI auto-disables keys it detects leaked publicly.
- Exposed in a client-side/browser bundle instead of being called from your server.
- Hardcoded in a notebook, script, or Dockerfile that got shared.
- Leaked via logs, a screenshot, or a pasted snippet in chat/forums.
Scan your repo and live site for exposed OpenAI API Keys — free
Trust checks your code, git history, and shipped JavaScript. No signup, results in about a minute.
Run a free scan →How to rotate a leaked OpenAI API Key
- Go to platform.openai.com/api-keys and sign in.
- Find the leaked key and click the Delete (trash) icon next to it — revocation is immediate.
- Click ‘Create new secret key,’ scope it to the right project, and copy it once.
- Update your server environment/secrets with the new key and redeploy.
- Check Usage and billing for spikes; lower your usage limit if you saw abuse.
- Confirm your app works on the new key, then leave the old one deleted.