How do I rotate an OpenAI API key after it leaks?

Short answer

Go to platform.openai.com/api-keys, delete the leaked key, create a new one with minimum permissions, and update every environment (Vercel, GitHub Actions, .env). Contact OpenAI support within 7 days for fraud reversal if the key was used.

Exact steps:

**Revoke**: platform.openai.com/api-keys → click the old key → Revoke. Takes effect in seconds.
**Create replacement**: Issue a new key. Scope it tightly if you can (project-scoped keys + restricted scopes).
**Rotate**: Update every place the key is used. - Vercel: Settings → Environment Variables → update - GitHub Actions: Settings → Secrets - Local: .env / .env.local — delete old, add new - Docker: rebuild images
**Audit usage**: platform.openai.com/usage — look for anomalies in the last 24-48 hours.
**Fraud ticket**: If you see usage you didn't authorize, open a support ticket with OpenAI. They reverse fraud within 7 days given evidence (commit hash + rotation timestamp + usage graph).
**Prevent next leak**: enable per-project spend caps; enable GitHub push protection; never prefix with NEXT_PUBLIC_.

How do I rotate an OpenAI API key after it leaks?

People also ask