Practical guide · By Aurelio Avila · October 15, 2026

How to stop API keys leaking into AI prompts

Nobody pastes an API key into ChatGPT on purpose. It travels inside something else: a stack trace, a config snippet, a curl command copied from the terminal. This guide covers where keys hide, a routine that catches them before you send, and what to do if one already went through.

Where keys hide in a prompt

Copied commands. curl -H "Authorization: Bearer …" carries a working token. See Bearer tokens.
Config and .env snippets. DB_PASSWORD=…, JWT_SECRET: …, "apiKey": "…". The value has no recognisable format; the name gives it away. See secrets in configuration values.
Connection strings. postgres://user:password@host/db in an error message. See passwords in URLs.
Logs and stack traces. Request dumps print headers, session tokens and JWTs.
Notebooks and scripts. login(token="hf_…"), OpenAI(api_key="sk-proj-…"), a deploy key in a cell.

Most provider keys have a fixed prefix, which is why they are easy to spot once you know them: GitHub ghp_ and github_pat_, OpenAI sk-proj-, Anthropic sk-ant-, Stripe sk_live_, AWS AKIA, Slack xoxb-, Google AIza. The detection reference lists every format Redaxa recognises.

A 30-second routine before you paste

Paste the lines that matter, not the file. The AI needs the error and the code around it, not the whole .env or log.
Keep the name, replace the value. OPENAI_API_KEY=[SECRET] tells the assistant everything it needs about your configuration.
Look for the prefixes above and for Authorization, password, secret and token.
Let a check run at the moment you send. The free Redaxa extension does this inside ChatGPT, Claude, Gemini and Perplexity: when you press Enter or Send, it checks the message on your device first and stops it if something needs a look. You choose between the redacted version and sending anyway; closing the notice leaves the message unsent.
Read the redacted version before you use it. A check that finds nothing is not proof that the text is safe.

A worked example, run through Redaxa's engine:

Before: curl -H "Authorization: Bearer RedaxaDocsSampleNotRealRedaxaDocs" https://api.example.com/v1/me returns 401
After:  curl -H "Authorization: [SECRET]" https://api.example.com/v1/me returns 401

The question still makes sense, and the token is gone. (The token is synthetic.)

What a check can and cannot catch

Redaxa recognises keys with a known prefix or exact format, secrets assigned to names such as API_KEY, SECRET, TOKEN or PASSWORD, passwords inside URLs, bearer tokens, JWTs and PEM private keys. It also flags personal and financial data in the same pass.

It cannot recognise a random string pasted on its own, with no prefix and no telling name around it. It also never tests whether a key works: a finding means "this looks like a credential", not "this credential is live". Each detector page lists the near misses it skips and the false positives it still has.

If a key already went into a chat

Rotate it at the provider (full steps: I pasted an API key into ChatGPT). Deleting the message or the conversation does not revoke the key. Every detector page has the provider's own revocation steps, for example OpenAI keys or GitHub tokens.
Check usage for the time the key was exposed: API usage, billing, audit logs.
Find where it came from. If the key was in a file you copied from, it may also be in your repository. Check a public GitHub repository free (3 checks a day, values always masked).

OpenAI's own advice applies to every provider: keep keys out of your code and out of shared places, and use environment variables or a secret manager (OpenAI: best practices for API key safety; OWASP Secrets Management Cheat Sheet).

FAQ

Does deleting the chat remove the risk?

No. Deleting a conversation does not revoke the key. Rotate it with the provider that issued it; that is the only step that makes the old value useless.

Does the Redaxa extension send my prompt anywhere?

Free checks run in your browser and send nothing. With a Pro or Business plan, the check runs on Redaxa's server so your protected terms and team policies apply; the text is not stored and not forwarded to an AI provider.

Will it catch every API key?

No. It recognises keys with a known prefix or format and secrets assigned to a telling name such as API_KEY or DB_PASSWORD. A random string pasted on its own, with no prefix and no name, is not flagged.

Is it free?

Yes. The Chrome extension's free checks need no account and have no daily limit. On the web you get 5 free prompt checks a day and 3 public repository checks a day.

Check your next prompt

Add the free Chrome extension

Prefer not to install anything? Run a free check on the web. Teams can set a policy that blocks sending when a credential is found: that is part of Business. Pro and Business start with a 3-day free trial: a card or another payment method is needed, nothing is charged for 3 days, and you can cancel before it ends from Manage subscription. See plans.