I committed an API key to GitHub: what to do

First: the key is exposed, whatever you do next

If the repository is public, assume the key has already been read: automated scrapers look for credential patterns continuously, and the value stays in Git history even after you delete the line. If the repository is private, the key is exposed to everyone with access, to forks, to clones and to any tool that was given a token. Either way the order is the same, and cleaning the history comes last, not first.

1. Revoke or rotate the key at the provider. GitHub's guidance on a leaked secret starts here as well. Provider-by-provider steps are on the detector pages, for example GitHub tokens, AWS keys, OpenAI keys and Stripe keys.
2. Review usage for the exposure window: from the commit's push time until the revocation. Look for calls, logins, instances or charges you did not make.
3. Put the replacement somewhere that Git never sees. An environment variable, your host's secret settings, or a secret manager; and add the file that held the old key (for example .env) to .gitignore.
4. Remove the key from the current files in a normal commit, so nobody copies it from the latest version.
5. Only then decide about rewriting history. Once the key is revoked, the old value is dead, and rewriting history is hygiene rather than a security fix. It is still worth doing if the history contains other secrets or personal data. GitHub documents the process in Removing sensitive data from a repository, and the tool it points to for the rewrite is git-filter-repo. A rewrite changes commit hashes, so everyone with a clone must re-clone, and forks and cached views are not cleaned by it.

Find out what else is in the repository

One leaked key usually means there are more: a second environment file, an old example config, a token in a test fixture. Before you close the incident, check the whole repository.

• Free web check, public repositories only. Paste the repository link at the Redaxa repository check. It reads the text files of the default branch, shows each finding with the value masked, and lists every file it skipped. Walkthrough: Check a public GitHub repo for leaked API keys. What it reads and what it does not: Free GitHub secret scanner: what the web check reads and its limits.
• Git history. The web check does not read past commits. The Redaxa Windows app can check the history and archives of a public repository locally with a Pro or Business plan. Open-source command-line scanners also read history; pick the one your team already trusts.
• Private repositories. Redaxa checks public repositories only. For private ones, use GitHub's own secret scanning if your plan includes it, or a scanner you run yourself.

A clean result is not proof that nothing is exposed: it means the enabled checks found nothing in the files that were read. Redaxa never tests whether a key works, so a finding means "this looks like a credential", not "this credential is live".

Stop the next one before it is pushed

GitHub's push protection can block a push that contains a supported secret; check in your repository settings whether it is available and switched on for your plan. Keep real values out of example files, and commit a .env.example with placeholders only.

The other common route for the same key is a chat: people paste the failing file into an AI assistant. If that happened too, read I pasted an API key into ChatGPT: what to do now.

Check a public repository free Add the free Chrome extension

Related

• Check a public GitHub repo for leaked API keys
• Free GitHub secret scanner: what the web check reads
• I pasted an API key into ChatGPT: what to do now
• What Redaxa detects: the full detection reference