I accidentally committed an API key to Git. What now?

1. Revoke the key in Console › API keys straight away. Assume it's been copied, even in a private repo.
2. Create a new key and store it outside the code (environment variable or secret settings).
3. Remove the key from the code and commit.
4. Clean the history. The old commit still contains the key. Rewrite history with your Git tooling if the repository is shared, or accept that the revoked key is dead and harmless.
5. Check Logs for requests made with the old key that you don't recognise.

Add .env and other secret files to .gitignore so it doesn't happen again.

Good to know#

• Never put a key in front-end code, a mobile app, a public repo or a screenshot.
• Give each integration its own key with only the permissions it needs.

Learn more#

• Limits and best practices
• API keys guide
• Abuse policy

Still need help?#

• General support: support@clatterlabs.com or team@clatterlabs.xyz
• Infrastructure questions, or permanent deletion of your data (your whole account or one service): infrastructure@clatterlabs.xyz

We usually reply within the first hour, and always within 24 hours. A full support team is with you.