LeakPatrolHow to check if your API key is exposed on your website
If a secret API key is in your website's JavaScript, anyone can copy it in seconds, and bots scan new sites for exactly that. Here's how to check your own site, what the common key formats look like, and what to do if you find one.
Check your site in two minutes
- Open your live website in Chrome, Edge or Firefox.
- Open DevTools (F12, or Cmd+Option+I on a Mac) and go to Sources.
- Press Ctrl+Shift+F (Cmd+Option+F on a Mac) to search across all files.
- Search for each of the prefixes below. A secret key should never appear.
What leaked keys look like
| Service | Secret key starts with | Risk |
|---|---|---|
| OpenAI | sk-proj-, sk- | Usage billed to you |
| Anthropic | sk-ant- | Usage billed to you |
| Stripe | sk_live_, rk_live_ | Refunds, payouts, customer data |
| AWS | AKIA, ASIA | Whatever the key can reach |
| Supabase | service_role JWT, sb_secret_ | Your whole database |
| GitHub | ghp_, github_pat_ | Your repositories |
AIza | Depends on restrictions |
Some keys are meant to be public: Stripe publishable keys (pk_live_) and the Supabase anon key are fine in the browser.
Why keys end up in the frontend
In apps built with Vite, Next.js or Create React App, environment variables starting with VITE_, NEXT_PUBLIC_ or REACT_APP_ are bundled into the JavaScript every visitor downloads. AI coding tools often use these prefixes to make a feature work quickly. Other common leaks are a public .env file (try opening yoursite.com/.env) and public source maps.
If you find a leaked key
- Rotate it now in the provider's dashboard. Deleting it from your code is not enough: it's already been downloaded.
- Move the call to a server, such as a serverless function or Supabase Edge Function, that reads the key from a secret.
- Set a spend limit for AI providers so a future leak can't run up an unlimited bill.
- Check the provider's usage logs for anything you don't recognise.
LeakPatrol does this check automatically: paste your site's address and it searches every JavaScript file it loads for more than 10 kinds of secret key, plus public .env files, .git folders and source maps. It's free and read-only, and any key it finds is masked.
Check your app in a minute
Free, read-only, no sign-up. Every problem comes with a plain-English fix and a prompt for your AI tool.
Scan your app freeQuestions
How do I know if my API key is exposed?
Open your live website, go to DevTools, search all JavaScript files for key prefixes such as sk-, sk_live_, AKIA and service_role, or use a free read-only scanner like LeakPatrol.
Is it safe to put an API key in frontend JavaScript?
Only public keys such as Stripe publishable keys or the Supabase anon key. Secret keys must stay on a server, because anything in frontend JavaScript can be read by every visitor.
What should I do if my OpenAI API key was exposed?
Revoke it in the OpenAI dashboard immediately, create a new one, move OpenAI calls to a server-side function, and set a monthly spend limit.