First 10 minutes: make the old key useless
Create a new key, then revoke the old one
Do this in the provider’s dashboard (Stripe, OpenAI, Anthropic, Supabase, AWS, Resend…). Most call it “roll”, “rotate” or “revoke”. The old key stops working the moment you revoke it.
Put the new key where it belongs
Secret keys go in your hosting provider’s server-side settings (environment variables or secrets), never in code that runs in the browser. Then redeploy so your app uses the new key.
Check your app still works
Try the feature that used the key: a payment, an AI reply, an email. If it broke, the new key isn’t set in the right place yet.
Next 30 minutes: see whether it was used
- Open the provider’s usage or logs page and look for activity you don’t recognise since the key went public.
- For payment keys, check recent refunds, payouts and new connected accounts. For AI keys, check spend by day.
- Set a spending limit or usage alert if the provider offers one.
- If you see charges that aren’t yours, contact the provider’s support. Many will help with charges from a leaked key that you report quickly.
Then: close the gap
- Remove the key from your code. If it was in a public Git repository, it also lives in the history; rotating it (above) is what actually protects you.
- Ask your AI builder to move the call that needs the key to the server side, for example a backend function, so the browser never sees it.
- Run a scan of your live site afterwards to confirm no secret keys remain in it.
How to stop it happening again
Most leaks happen when an AI tool calls a paid service straight from the page to make a feature work quickly. When you ask for a feature that uses a paid service, add: “Keep the key on the server; the website must never contain it.”