What to do if your ClearRun API key leaked

Revoke the key on the API keys page right away. It stops working at once, and your other keys keep working. Then create a new key, update your secrets, and check Usage history for calls you didn't make.

Last updated

Steps

  1. Revoke the leaked key

    Open the API keys page. Find the key by its name and first characters, and choose Revoke. It stops working right away: any call with it gets 401 { "error": "Unauthorized" }, the same as an unknown key. See How to revoke a ClearRun API key.

  2. Create a new key and update your secrets

    Create a key at api.clearrun.net/account/keys, then replace the old one in your environment variables, CI secrets and MCP configs. See How to rotate a ClearRun API key.

  3. Can't tell which key leaked? Stop them all

    Open Account settings. Under Data & Privacy, clear the API access box and choose Save Changes. Every key stops working until you turn it back on. Revoke the keys you don't trust before you do.

Check what it was used for

Open Usage history on the billing page. Each paid call shows which key made it.

Remove it from where it leaked

Delete it from the repo, log or message. If it was committed, removing it from the latest commit is not enough. It is still in the history. Revoking the key is what makes it safe.