Free resource

The leaked AI key playbook.

What to do in the first hour after an OpenAI, Anthropic, Gemini or Amazon Bedrock key leaks, taken from each provider's own docs. Every step links its source.

Last checked Nov 4, 2026. Provider docs change often, so each row links the page it came from.

The order that works everywhere.

Google and AWS both put the replacement first and the delete last, so your app keeps running while the old key stops working.

  1. Create a replacement key

    Make the new key in the provider console and keep it out of source control. Gemini leak checklist OpenAI key safety

  2. Deploy the new key

    Update every app and pipeline that used the old one. Source

  3. Disable or delete the leaked key

    Google says to disable the leaked key once the new one works and to delete it only after the new key is fully active. AWS re:Post gives the same order for access keys: rotate, deactivate, then delete later. Gemini AWS re:Post

  4. Read the usage records

    OpenAI points to the Usage page. AWS suggests credential reports and Cost Explorer to spot activity you did not start. OpenAI AWS re:Post

  5. Tell the provider

    OpenAI asks you to contact help.openai.com after rotating a leaked key. Source

Provider by provider.

How to turn the key off, what caps spend, and what each provider does on its own when it finds a leak.

ProviderTurn the key offCap or alert on spendAutomatic leak response
OpenAIRotate the key from the API Keys page. Project keys can carry an expiration date, and admins can set a maximum key lifetime. IP allowlisting is available. SourceSpend alerts notify you and leave traffic running. Hard limits block requests, and spend can pass the limit slightly because enforcement is not instant. SourceUnverified on the cited page.
AnthropicDelete the key at platform.claude.com/settings/keys: open the three dot menu, then choose Delete API key. SourceUnverified here. Check your Console limits page.Through GitHub secret scanning, Anthropic deactivates keys exposed in public repos and emails the owner. Anthropic GitHub patterns
GeminiGenerate a new key, deploy it, then disable the leaked key in the Cloud console. SourceMonthly spend caps at the billing tier and project levels. Project caps are experimental, with overages possible for about 10 minutes. Budget alerts can also turn billing off through Pub/Sub, which stops every service on the project. Spend caps Disable billingAuth keys come with fast leaked key enforcement. From May 28, 2026, new AI Studio keys are auth keys and the Gemini API rejects unrestricted standard keys. Source
Amazon BedrockLong-term keys: set inactive, reset or delete with UpdateServiceSpecificCredential, ResetServiceSpecificCredential or DeleteServiceSpecificCredential. These calls use AWS credentials, not a Bedrock key. SourceAWS Budgets alerts and budget actions. Source Exact behavior for Bedrock keys: Unverified.AWS keys are a GitHub secret scanning pattern. Source Bedrock key coverage: Unverified.

Bedrock short-term keys.

AWS shuts out a short-term Bedrock key through IAM, in two ways: deny sessions issued before a time with aws:TokenIssueTime, or deny bearer token calls for the identity. The bearer token deny needs both actions. Source

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Action": [
      "bedrock:CallWithBearerToken",
      "bedrock-mantle:CallWithBearerToken"
    ],
    "Resource": "*"
  }]
}

Attach it to the IAM identity that minted the key. Check the policy text against the AWS page before you use it. AWS Bedrock docs

What spend limits cover.

The caps above apply to a whole account, project or billing tier. OpenAI and Google both note a short delay before a cap takes effect. OpenAI Gemini

That leaves one question the provider consoles answer slowly: which key spiked. Keyfuse compares each key to its own usual spend, names the one that jumped and switches it off where the provider supports it.

Give every key its own off switch.

Early access members get the free checker and paid plans first.

Get early access

Sources.

  1. OpenAI: Best practices for API key safety
  2. Anthropic: API key best practices
  3. Anthropic: What to do if your API key is compromised
  4. Google: Using Gemini API keys
  5. Google: Gemini API billing and spend caps
  6. Google Cloud: Create budgets
  7. Google Cloud: Disable billing with budget notifications
  8. AWS: Revoke Amazon Bedrock API keys
  9. AWS re:Post: Potential account compromise
  10. AWS: Budgets controls
  11. GitHub: Supported secret scanning patterns