Skip to main content
Treat any key that lands in a commit, a ticket, a log, or client-side code as compromised. An enc_ key can spend your account’s credits, so act fast.

​
Contain it now

1

Permanently delete the exposed key

Delete it from the dashboard’s API Keys page, or call DELETE /api/account/keys?id={id}&permanent=true. See Revoke or delete API key.
2

Issue a replacement

Create a new key from the dashboard or the API, store it in your secret manager, and deploy it.
3

Check what it did

Review the key’s usage with list-keys. credits_used and last_used_at show whether it was abused before deletion.
Known issue: Revocation is not final. A revoked key can be enabled again, and its secret can still be revealed. Revoked and disabled keys both appear as is_active: false. Permanently delete a leaked key.

​
Limit the blast radius next time

Cap each key's spend

Set a per-key credit limit so a leaked key stops at a ceiling instead of draining your balance.

One key per service

Name keys by where they run (production-backend) so you can delete one without disrupting the rest.

Keep keys out of code

Store keys in environment variables or a secret manager, never in source control or client-side code.

Watch for abnormal spend

Subscribe to the credits.low and credits.exhausted webhooks to catch a runaway key early.

​
Next steps

API keys & authentication

Create, rotate, and cap keys.

Credits

How spend and free repeats work.