API keys are the passwords of the modern web. When they leak, attackers get direct access to your cloud infrastructure, payment systems, databases, and user data. Here's everything you need to know about API key leaks — and how to stop them.
An API key is a secret string that identifies and authenticates an application when it communicates with a service. Think of it like a password, but for software instead of people. When your app needs to send emails through SendGrid, charge a customer through Stripe, or store files in AWS S3, it uses an API key to prove it has permission.
API keys come in many formats:
Each of these strings grants significant access to the associated service. An AWS key can spin up servers, access databases, and read files. A Stripe key can view customer payment data and issue refunds. A GitHub token can read and modify source code.
API key leaks happen more often than most developers realize. Here are the most common ways keys end up exposed:
The most common leak vector. A developer hardcodes an API key during local development, then accidentally commits and pushes it to a public GitHub repository. Automated scanners monitor GitHub in real time — exposed keys are typically discovered by attackers within minutes.
GitHub reports that over 100 million secrets were leaked in public repositories in the past year alone. Automated bots scan every new commit within seconds of it being pushed.
When API keys are bundled into frontend JavaScript — through environment variable misuse, build tool misconfiguration, or simple mistakes — they become visible to anyone who views the page source. This is especially dangerous because the keys are exposed to every visitor, not just attackers who find them through code scanning.
Developers sometimes paste real API keys into documentation, tutorials, or Stack Overflow answers when showing code examples. Even if the key is "for testing only," attackers don't distinguish between test keys and production keys — they try everything.
Applications that log full request/response bodies may inadvertently capture API keys in log files. If those logs are accessible — through a misconfigured log dashboard, leaked log file, or error tracking service — the keys are exposed.
API keys hardcoded in mobile apps can be extracted through reverse engineering. Tools like strings, apktool, and various decompilers make this straightforward.
The consequences depend on the key type and the permissions it grants:
Never hardcode API keys in source code. Store them in environment variables and load them at runtime. Use .env files for local development and ensure .env is in your .gitignore.
For production environments, use a dedicated secrets manager like AWS Secrets Manager, HashiCorp Vault, or Doppler. These services provide encryption, access control, audit logging, and automatic rotation.
Create API keys with the minimum permissions needed. If a key only needs to read data, don't give it write access. If it only needs access to one S3 bucket, don't give it access to all buckets. This limits the damage if a key is compromised.
Set up automatic key rotation on a schedule. If a key leaks, regular rotation limits the window of exposure. Most cloud providers support automated rotation through their secrets management tools.
Use tools that detect leaked secrets before they reach production:
detect-secrets or gitleaks scan your code before it's committed.PhishClean's secret leak scanner runs in your browser, checking every page you visit for exposed API keys and credentials. It matches against 30+ known secret patterns — AWS keys, Stripe keys, GitHub tokens, database connection strings, and more.
This gives you an extra layer of protection that other tools don't cover:
PhishClean scans every page for exposed secrets — locally, in real time. 3-day free trial, no credit card required.
Install PhishCleanIf this helped, save it for later, share it with someone who would benefit from it, or subscribe for new browser-security guides from PhishClean.
Get practical phishing and browser-safety articles in your inbox. No salesy drip, just new guides and product updates when they are worth sending.