How to Find a Leaked OpenAI API Key: Complete Detection Guide

TL;DR: How to Find a Leaked OpenAI API Key

A leaked OpenAI API key is an exposed secret that allows anyone to use your OpenAI account and incur charges. To find one immediately: scan your Git history for `sk-` patterns, search your codebase for hardcoded keys, check environment variables in client-side code, and monitor your OpenAI usage dashboard for unusual activity. Use automated secret scanning tools to catch leaks in real time.

Why Finding a Leaked OpenAI API Key Matters

OpenAI API keys (starting with sk-) are the keys to your AI kingdom. If leaked, attackers can:

A single leaked key in a public GitHub repo can be scraped by bots within minutes. In 2023 alone, thousands of OpenAI keys were found exposed on GitHub. The average cost of a leaked API key incident for a solo developer is $500–$2,000 in unauthorized usage.

Where Leaked OpenAI API Keys Hide

1. Git History (Most Common)

Developers accidentally commit .env files or hardcoded keys. Even if you remove the file later, the key remains in Git history.

How to scan:

# Search all commits for OpenAI key pattern
git log --all --oneline -p | grep -E "sk-[a-zA-Z0-9]{20,}"

# Use git-secrets (install first)
git secrets --scan-history

2. Client-Side JavaScript and Source Maps

If you bundle an API key in your frontend code (e.g., in a Next.js getStaticProps that accidentally exposes it), it's visible in browser dev tools and source maps.

Check your deployed site:

3. Environment Variables in CI/CD Logs

Printing environment variables during build steps (e.g., echo $OPENAI_API_KEY in GitHub Actions) can leak keys in plaintext logs.

Scan CI logs:

# .github/workflows/ci.yml - look for echo or print of env vars
- name: Debug
  run: echo "My key is $OPENAI_API_KEY"  # DON'T DO THIS

4. Third-Party Services and Logs

5. NPM Dependencies and Build Artifacts

Malicious packages can scrape environment variables. Also, .env files in published npm packages are accessible to anyone who installs them.

Step-by-Step: How to Find a Leaked OpenAI API Key

Step 1: Check Your OpenAI Dashboard

Before scanning code, check your OpenAI API usage dashboard. Look for:

If you see unauthorized usage, rotate your key immediately.

Step 2: Scan Your Git Repositories

Use git secrets or truffleHog to scan entire history:

# Install truffleHog
trufflehog git https://github.com/yourusername/yourrepo --regex --entropy=False

For local repos:

grep -r "sk-[a-zA-Z0-9]\{20,\}" . --include="*.{js,ts,py,env,json,yaml,yml,config*}"

Step 3: Scan Deployed Frontend Code

Visit your live site and search page source for sk-. Also check:

Step 4: Use Automated Secret Scanning Tools

Tools like OverMCP automatically scan your GitHub repos, Vercel deployments, and npm dependencies for leaked secrets including OpenAI API keys. They alert you in real-time when a leak is detected.

# Example using OverMCP CLI (hypothetical)
npx overmcp scan --repo your/repo

Step 5: Search Public Sources

How to Fix a Leaked OpenAI API Key

git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch .env" \
  --prune-empty --tag-name-filter cat -- --all

Prevention: Never Leak Again

FAQ

How do I know if my OpenAI API key is leaked?

Check your OpenAI usage dashboard for unexpected charges or requests. Also scan your Git history and public repos for the sk- pattern. Automated tools like OverMCP can continuously monitor for leaks.

Can someone use my OpenAI API key without me knowing?

Yes, attackers can use your key to make API calls without triggering two-factor authentication. The only sign is unusual usage in your dashboard or a surprise bill. Regular monitoring is essential.

What should I do if I find a leaked OpenAI API key?

Immediately revoke the key in the OpenAI dashboard, generate a new one, update your environment variables, and remove the key from any public or version-controlled locations. Also scan for other secrets that may have been exposed alongside it.