What to do in the first hour after an API key leaks

Step 1: Deactivate or rotate the credential immediately

When an API key leaks, your immediate priority is stopping unauthorized API calls. Many developers instinctively start rewriting Git commits or force-pushing to hide their mistake, but that leaves the credential active while automated bots hammer your endpoints. GitHub specifically recommends rotating exposed credentials immediately upon receiving an alert, noting that removing secrets from Git history is time-intensive and often unnecessary once the credential is revoked.

If you're dealing with an AWS access key, don't delete it right away. The standard AWS remediation workflow is to generate a new access key, update your application, and deactivate the original key first. That lets you verify your application still works without downtime; if something breaks, you can temporarily reactivate the old key to fix the issue. Once you've verified your systems are running cleanly, delete the original key and remove any AWS root user access keys that you don't need or didn't create.

For OpenAI, go straight to the API Keys page and rotate the key right away. If you've got production services using it, you'll need to update those values immediately. OpenAI also recommends storing credentials in an operating system environment variable named OPENAI_API_KEY instead of hardcoding values into applications or committing them to repositories. If you suspect key misuse, contact OpenAI through help.openai.com for further investigation.

Step 2: Check your usage logs to see what ran

How do you know if someone actually used your leaked key? You need to check the provider's activity and billing pages right after disabling the credential. A compromised OpenAI key gives attackers unauthorized access to your account quota, which can lead to data loss, unexpected charges, monthly quota depletion, and sudden API interruptions. Check the Usage page in the OpenAI dashboard to see whether recent token consumption aligns with your team's actual work.

On AWS, the blast radius is often much wider. To identify unauthorized actions, start by generating IAM credential reports to audit passwords and access keys across every identity in your account. Next, pull up the IAM last accessed information for users, groups, roles, and policies to see which permissions were exercised recently.

Check your AWS billing footprint using three tools:

• AWS Cost Explorer to review recent charges and usage.
• AWS Cost and Usage Reports to get granular data on account spend.
• Trusted Advisor Recommendations for cost and security flags.

You must check for resources across all AWS Regions, including regions where you don't normally launch infrastructure. Attackers commonly spin up compute in distant regions to avoid notice. If you find an unauthorized Amazon EC2 instance that you need to preserve for regulatory, compliance, or legal investigation, create an Amazon EBS snapshot before you terminate the instance.

Step 3: Check for persistence and lock down access

Killing the exposed key doesn't guarantee your environment is clean. If the leaked key had administrative or provisioning permissions, the intruder might have created new backdoors to retain access.

In AWS, open the AWS CloudTrail console and navigate to the Event history page. Review the Event time column for unsanctioned activity, specifically looking for newly created access keys, policies, roles, or temporary security credentials. If you find any unsanctioned credentials or roles, delete them immediately.

While auditing IAM users in the console, check the user's Summary page under the Permissions tab. Look at the Permissions policies section to see if the AWSCompromisedKeyQuarantineV2 policy is attached. AWS applies this managed policy to restrict compromised identities. Go through your account, deactivate any IAM users you didn't create, update access keys for legitimate users, and change passwords for all users you manage.

Check your account-level information as well. Verify your AWS account name, root user email address, primary contact, and alternate contacts. For IAM users with console access, activate up to 8 MFA devices per user to secure authentication.

For OpenAI accounts, tighten your workspace structure:

• Stop sharing keys across your team. Sharing API keys violates OpenAI's Terms of Use; instead, invite team members from the Members page so each person receives their own unique key.
• Set up project keys with expiration dates so requests are rejected automatically once the key expires.
• Enforce a maximum API key lifetime in Platform settings at the organization or project level (project limits cannot exceed the organization limit).
• Enable IP allowlisting to block requests from unlisted IPs, even if a request carries a valid key.
• For supported workloads, switch to workload identity federation to swap trusted provider identities for short-lived access tokens instead of storing long-lived keys. If you use Azure workloads, OpenAI supports Azure Private Link for regional endpoints, though it isn't compatible with IP allowlisting or mutual TLS (mTLS).

Comparing GitHub secret detection and prevention options

Does GitHub detect leaked API keys? Yes, but what it catches and blocks depends heavily on your repository type and your plan.

GitHub secret scanning searches your entire Git history across all branches for credentials like API keys, passwords, and tokens. It also automatically scans issue descriptions and comments, historical open and closed issues, pull request titles and comments, GitHub Discussions, Wikis, and secret gists. When partner secrets are found, GitHub alerts the provider directly so they can revoke the token, meaning partner secrets won't show up in your repository alerts tab.

Here is how GitHub secret scanning and push protection compare across different setups:

Push protection stops credentials before they ever reach the repository. When a commit contains an exposed secret, the push is blocked with a message explaining why. Anyone with write access can bypass repository push protection by default, but bypassing creates an alert in the Security and quality tab, logs an event in the audit log, and emails watching repository administrators, security managers, and owners. If someone selects "It's used in tests" or "It's a false positive", GitHub resolves it as a closed alert; selecting "I'll fix it later" leaves an open alert. GitHub also has push protection for AI-detected unstructured secrets (such as passwords) in public preview.

Set hard spending limits before the next incident

Revoking keys cleans up the immediate mess, but you also need cost ceilings so a leak doesn't run up a massive bill overnight.

On OpenAI, set monthly spend limits at the project or organization level and turn on hard enforcement. Spend alerts alone won't stop API traffic. Hard enforcement blocks requests once reached, though OpenAI notes spend might slightly exceed the limit because enforcement isn't instantaneous. You can read more about setting these controls in our guide on how do I set a hard spending limit on the OpenAI API?.

Catch runaway spend automatically with Costbrake

When you're running lean, you can't sit in AWS Cost Explorer or CloudTrail all day watching for rogue EC2 instances. That is why we built Costbrake.

Costbrake tracks what you spend across 23 cloud, AI, and SaaS providers, including AWS, OpenAI, Anthropic, Google Cloud, Azure, Cloudflare, GitHub, Vercel, and Supabase. On the Free plan ($0 for 2 connections, 3 budgets, and 1 seat), Costbrake runs checks hourly. On the Pro plan ($12 a month or $120 a year) and Team plan ($39 a month or $390 a year), checks run every 5 minutes, tightening to as often as once a minute during an active spike, depending on the provider.

Costbrake fires a spike alert whenever an hour costs more than 3x your 7-day baseline and at least $5 more than usual. You also get threshold alerts at 50%, 80%, and 100% of your budget, month-end forecast alerts when your last 72 hours of spend puts you over budget, and alerts when any new service bills over $1 for the first time this month. Alerts deliver via email on Free, with Slack, Discord, and signed webhooks on Pro, and PagerDuty on Team.

If an API key leaks and spend begins climbing, Pro and Team plans include opt-in, reversible brakes across 18 providers. An admin must manually click and confirm every action; Costbrake never executes a brake automatically. For example, a brake can turn off an AWS IAM access key, throttle a Lambda function to zero, stop an EC2 instance, or freeze an OpenAI monthly hard spend limit at $0.01 so paid calls return 429s once OpenAI enforces it (usually within minutes). All stored credentials are encrypted with AES-256-GCM.

Every workspace starts with a 14-day Pro trial without requiring a card. You can connect your accounts manually at https://app.costbrake.com/signin or tell your AI tool to handle agent setup. You can review all plan tiers on our Costbrake pricing page, or read about automated response strategies in our guide to what is a cloud killswitch, and should I have one?.