You leaked an API key. Do these six things now.
Work through them in order. The first one takes a minute and stops the bleeding; the rest make sure it doesn't happen again and give you what you need if you ask the provider for a refund.
Revoke or regenerate the key at the provider
Don't wait to check whether it was used. Assume it was. Delete the key, create a new one, and update your deployment before anything else.
Check usage for the window since the leak
Open the provider's usage or billing page and look from the moment the key could have been seen (the commit, the deploy, the log line) until now. Unfamiliar models, regions, endpoints or a sudden spike in volume tell you it was used. Write down the times; you'll need them in step 6.
Lock down every other key and set a budget alert
Restrict each remaining key to only the APIs it needs. An unrestricted key gains new powers the moment someone enables another API on the project. Delete keys nobody uses, and set a budget alert and spend limit on the provider account.
Remove it from the bundle and git history
Anything in a
VITE_,NEXT_PUBLIC_orREACT_APP_variable ships to every visitor. If the key was committed, deleting it in a new commit isn't enough: rewrite history (git filter-repo or BFG) or make the repo private, and remember forks and clones still have it. Turn on GitHub push protection so the next one is blocked before it lands.Put the new key behind KeyVault Edge
Store the new provider key once and give each app a stand-in token instead. Each token carries its own requests-per-minute limit, allowed endpoints, monthly cost cap and expiry, and you can revoke it in one click without touching the provider key. Then redeploy with the token.
Download the incident report for your refund claim
Providers ask for specifics when you dispute charges. For traffic that went through KeyVault Edge, the incident report lists every proxied request and every blocked attempt in the window: time, source IP, origin, endpoint, status and estimated cost, as a CSV you can attach to the case.
Sign in to download the reportIt covers requests made through KeyVault Edge tokens. Calls made directly with the leaked provider key only show up in the provider's own usage logs.
What KeyVault Edge doesn't do
- It can't revoke a key at the provider for you, and it can't get your money back. Step 1 and the refund request are yours.
- A token a browser can see can still be copied and replayed from a server. The protection is that each token is limited and can be revoked in one click.
- Cost caps and report costs are estimates from provider-reported usage, not the provider's invoice.
Make the next leak a small one
14-day free trial, then plans from $9/month. Want help moving a key? Email support@keyvaultedge.com and we'll walk you through it.