What to do if a secret key leaks
Replace and revoke a key without downtime, in three steps.
If a secret key may have been exposed, replace it straight away. You can do it without downtime.
Replace and revoke
- In Developers → API keys, create a new key with the same access.
- Deploy it to your servers in place of the old one.
- Revoke the old key. It stops working at once.
Then check
Review the audit log and recent payments for anything you don't recognize. Your wallet is safe either way: no API key can move its funds.
More tips in security best practices.
Was this article helpful?