Home / Guides / Leaked OpenAI API key: how to check and what to do

Leaked OpenAI API key: how to check and what to do

How to tell if your OpenAI key is exposed in your frontend or repo, how to revoke and replace it, and how to call OpenAI safely from a vibe-coded app.

If your app calls OpenAI straight from the browser, your API key is in your JavaScript bundle, and anyone who opens dev tools can copy it and spend your credits. AI builders do this often when you ask for "a chatbot" and don't say where the key should live.

How to check

  1. Open your live site, then dev tools → Sources (or view source) and search the loaded .js files for sk-. OpenAI keys start with sk-, and newer ones with sk-proj-.
  2. Search your repo too, including old commits. A key that was ever pushed to a public repo should be treated as leaked.
  3. Check that https://YOUR_DOMAIN/.env does not download (see How to check if your .env is exposed).

What to do if it leaked

  1. Revoke it first. In the OpenAI platform dashboard, go to API keys and delete the exposed key. Deleting it from your code does nothing; copies already exist.
  2. Create a new key and put it only in server-side environment variables (your host's secrets, a Supabase Edge Function secret, etc.). Never in a variable that gets bundled for the browser, such as ones prefixed VITE_, NEXT_PUBLIC_ or EXPO_PUBLIC_.
  3. Look at usage for the time the key was public and set a monthly budget limit on the project so a future leak has a ceiling.
  4. Proxy the calls. Your frontend calls your own endpoint; that endpoint checks the user is signed in, applies a rate limit, and calls OpenAI with the server-side key.
Copy-paste into your AI builder
My OpenAI API key is currently used in frontend code. Move every OpenAI call into a server-side function (an API route or Supabase Edge Function). Read the key from a server-only environment variable, never one prefixed VITE_, NEXT_PUBLIC_ or EXPO_PUBLIC_. Require a signed-in user and add a simple per-user rate limit. Remove the key from all client code and tell me every file you changed.

Related: Hide API keys when an AI builder writes your app · Exposed service_role key

Scan your app free

Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down.

Scan free at shiplatch.com →

More guides