Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If an API key or token is exposed, treat it as actively compromised. Revoke or disable it in the issuing provider first, create a least-privilege replacement, deploy and test the replacement everywhere the old value was used, then disable and delete the old credential when the provider supports both actions. Finally, investigate use of the credential and remove the exposure from repositories, build systems, logs, and local files. Deleting a key from source code or Git history alone does not stop an attacker who already copied it.
The exact behavior depends on the provider: some credentials can overlap briefly during deployment, some become invalid immediately, and already-issued short-lived tokens may remain usable until they expire. The procedure below separates those cases so you can contain the incident without creating an avoidable outage.
What should I do first when an API key is exposed?
Start with containment, not cleanup. Record what was exposed and revoke it at the issuer before changing code or rewriting repository history.
- Assume compromise. Note the provider, credential type, owner, permissions, environments, repositories, CI/CD jobs, integrations, and the earliest likely exposure time. Treat a public leak as active until the provider confirms invalidation.
- Revoke or disable at the issuer. Use the provider’s control plane or credential API. This is the action that blocks future authentication; deleting a file does not.
- Create a replacement. Give it only the APIs, scopes, audiences, IP or referrer restrictions, and application access the workload actually needs. Issue a separate credential for each application or team when possible.
- Deploy and verify. Replace the old value in application configuration, secret stores, environment variables, scheduled jobs, deployment manifests, and third-party integrations. Exercise the affected paths and check authentication or request logs.
- Retire the old credential. If the provider has separate disable and delete operations, disable first, monitor for missed consumers, then delete after the replacement is confirmed.
- Investigate. Review access logs, billing, data reads, configuration changes, payouts, and other provider actions during the exposure window. Rotate related credentials if the evidence suggests a broader compromise.
- Remove the exposure path. Clean working trees and history where policy requires, notify repository users and incident stakeholders, and fix the process that allowed the secret to leak.
Keep an incident record containing timestamps, credential identifiers, actions taken, affected services, and evidence collected. Do not paste the secret itself into the ticket.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What is the difference between revoking and rotating a leaked credential?
Revocation stops a credential from authenticating. Rotation is the complete replacement process: revoke or disable the exposed value, issue a new one, update consumers, verify operation, and retire the old value.
For an incident, revocation comes first because an attacker can continue using a copied bearer credential while you edit source code. Rotation then restores service with a new identity. If a provider supports a short overlap, use it only for the time needed to deploy and verify; leaving both credentials active indefinitely preserves the original risk.
Do not assume every token can be invalidated on demand. Google Cloud documents that already-issued service-account access tokens cannot be manually revoked and remain valid until expiry, commonly up to 60 minutes or up to 12 hours when an extended token-lifetime policy applies. In that situation, revoke the credential that can mint new tokens, reduce permissions where possible, and monitor until existing tokens expire.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow can I rotate a key without downtime?
Zero downtime is possible only when the provider and your application support a controlled overlap. Plan the consumer changes before invalidating the old value, and test the new credential independently.
Inventory every consumer before changing the secret
Search production and non-production configuration, container definitions, serverless settings, worker processes, cron jobs, CI/CD variables, infrastructure code, notebooks, local developer files, and vendor integrations. Include replicas and regional deployments; a single forgotten worker can fail hours after the main application is updated.
Design a dual-key or staged deployment
Where the provider allows two active credentials, add the replacement to the secret store under a new name. Deploy code that can authenticate with the replacement while retaining the old value only as a fallback. Prefer selecting the new credential explicitly rather than silently trying many values, because fallback can hide a failed rollout.
Canary the replacement
Send a controlled request from a staging or canary instance using the new credential. Confirm the expected permission boundary, response codes, latency, and provider audit entry. Then shift production instances gradually if your platform supports a rolling or percentage-based deployment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Remove the old value promptly
After all consumers use the replacement and logs show successful requests, disable the old credential. Keep it only for the provider-supported verification window. Delete it after monitoring confirms that no legitimate consumer still depends on it.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Prepare for providers with immediate expiry
If rotation invalidates the old key immediately, pre-stage the replacement in every configuration location, schedule a coordinated deployment, and have a tested rollback that uses a newly issued credential. Do not rely on the revoked value as a rollback path.
How do I rotate an exposed key step by step?
1. Identify the credential and exposure window
Capture the credential ID or last four characters, issuing account, creation date, scopes, restrictions, and owning service. Determine whether the value appeared in a public repository, pull request, build log, support ticket, client bundle, browser code, or machine image. Estimate when it first became accessible and who or what could have downloaded it.
Classify the credential by capability. A read-only key for one API has a smaller blast radius than an administrator token that can change billing, users, networking, or payout settings. The classification determines how broadly you investigate and whether related credentials require rotation.
Recommended Free Tools
2. Revoke or disable it in the provider control plane
Use the provider’s documented revoke, disable, or delete action. OWASP’s incident guidance puts the order plainly: “Rotate it immediately — revoke the exposed credential in the issuing system first, before anything else.” Record the time and the provider’s confirmation or audit event.
If the interface offers only deletion, verify whether deletion is irreversible and whether the identifier can ever be reactivated. GitHub states that revoked credentials cannot be reactivated; you must create new credentials.
3. Issue a least-privilege replacement
Match the replacement to the workload rather than copying the old credential’s broad permissions. Restrict by API, IP address, HTTP referrer, application, audience, or environment where the provider supports those controls. Use separate credentials for production, staging, development, and independent applications so one leak does not expose every environment.
Give the replacement a clear owner and expiry or review date. Store it directly in an encrypted secret manager or CI/CD secret store; do not place it in a plaintext configuration file or command history.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Replace every copy
Update application settings, deployment manifests, container and orchestration secrets, serverless environment variables, scheduled tasks, integration platforms, documentation examples, and local bootstrap scripts. Search for the credential’s variable name as well as its value, because some copies may be transformed or encoded.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Restart or redeploy processes that read secrets only at startup. For long-running workers, verify that the new value is loaded rather than assuming a configuration update is live.
5. Verify behavior and permissions
Exercise the production paths that use the credential, including background jobs and error-handling branches. Confirm successful requests in provider logs and check that calls outside the intended scope fail as expected. A replacement that works only because it retained excessive permissions is not a successful remediation.
Watch error rates, queue backlogs, retries, and latency during the deployment. A failed authentication storm can create secondary outages even after the key itself is secure.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →6. Disable, monitor, and delete the old key
When the provider separates these actions, disable the replaced key first. Monitor authentication failures and usage metrics for missed consumers. Delete it after the agreed verification period and preserve the credential identifier and audit record, not the secret value.
Google Cloud’s documented service-account sequence is identify, create a replacement, update all applications, disable the replaced key, monitor, and delete it. Google recommends rotating managed service-account keys at least every 90 days and immediately when compromise is suspected.
7. Investigate and recover
Review provider authentication events and request logs for the full exposure window and for a period after revocation. Look for unusual IP addresses, geographies, user agents, request volume, data reads, configuration changes, new users, altered permissions, and unexpected billing.
For payment systems, inspect unfamiliar connected accounts, payouts, bank accounts, charges, and refunds. Stripe specifically advises reviewing these indicators and rotating additional secret or restricted keys if the exposure may extend beyond one credential.
How do GitHub, Google Cloud, and Stripe handle leaked credentials?
Provider behavior differs enough that the same playbook cannot be applied blindly. The following cases illustrate the decisions that matter: revocation timing, overlap, token lifetime, restrictions, and audit visibility.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Provider and credential | Documented response | Expiry or overlap behavior | Important controls and checks |
|---|---|---|---|
| GitHub personal access and related tokens | The revocation API accepts classic and fine-grained personal access tokens plus several OAuth and GitHub App token types. Revoked credentials cannot be reactivated; create new credentials. | Revocation invalidates the credential; do not plan on reusing it for rollback. | Update every repository automation and integration that used the token, then review repository and organization activity. |
| Google Cloud service-account keys | Identify the key, create a replacement, update applications, disable the old key, monitor, and delete it. Google recommends rotation at least every 90 days and immediately after suspected compromise. | Disable and delete are separate stages, allowing a short verification interval. | Apply API, IP, application, or audience restrictions and inspect Cloud audit activity, configuration changes, and billing. |
| Google Cloud short-lived service-account access tokens | Revoke the credential that issued or minted the token and block further issuance. | Already-issued tokens cannot be manually invalidated; they commonly remain valid up to 60 minutes, or up to 12 hours with an extended token-lifetime policy. | Reduce the issuing credential’s permissions and monitor until token expiry. |
| Stripe secret or restricted keys | Rotate in the Dashboard, choose an expiry long enough to test, update the backend, verify new-key request logs, and delete the compromised key. | The selected expiry determines how long the old key remains usable during testing. | Review unfamiliar connected accounts, payouts, bank accounts, charges, and refunds; rotate other affected secret or restricted keys. |
How long can a leaked token still be used after deletion?
A deleted source file has no effect on a credential that was already copied. A revoked key normally stops working according to the issuer’s revocation model, but a token that was issued earlier may have its own lifetime and may continue to authorize requests.
Bearer tokens are especially dangerous because possession is usually sufficient; an attacker does not need your repository or server after obtaining the value. For short-lived tokens, calculate the maximum remaining lifetime from the provider’s policy and keep monitoring for that period. For long-lived keys, assume use can continue until the issuer confirms revocation.
Do not promise users or stakeholders that every active session is invalidated when you delete a key. State exactly what was revoked, what may remain valid until expiry, and what compensating controls are in place.
What should I look for when investigating use of a leaked credential?
Build the investigation around the credential’s permissions and the provider’s telemetry. Preserve logs before retention windows erase them, and compare activity with normal baselines for the owning service.
- Authentication: first and last seen times, source IPs, regions, user agents, failure bursts, and token or key identifiers.
- API activity: unusual endpoints, methods, request volume, export or download operations, and access to data outside the service’s normal tenant or project.
- Control-plane changes: new keys, users, roles, OAuth grants, webhooks, network rules, storage policies, or deployment settings.
- Financial impact: unexpected usage charges, resource creation, purchases, payouts, refunds, or payment-method changes.
- Persistence: modified automation, scheduled jobs, CI/CD variables, backdoors, or newly trusted applications.
Compare suspicious events with deployment and maintenance records. If the credential could alter permissions or create new credentials, treat every identity and secret reachable through those actions as potentially affected until checked.
How do I remove a leaked secret from Git safely?
First revoke the credential; history cleanup is secondary. GitHub warns that removing a secret from code or deleting a repository does not prevent exploitation because clones, forks, caches, logs, and other copies may persist.
- Revoke or disable the credential at the issuer and issue its replacement.
- Update all consumers and confirm that the replacement works.
- Remove the secret from the working tree and any generated artifacts.
- Use your organization’s approved history-rewrite procedure to remove committed copies from affected branches and tags.
- Notify contributors and automation owners because existing clones and forks still contain the old history.
- Enable secret scanning and push protection where available, and verify that scanners detect the replacement format without exposing the new value.
History rewriting cannot recall a value that has already been downloaded. Keep the incident’s evidence and audit references separately from the rewritten repository.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhich controls prevent another API-key leak?
Prevention combines short credential lifetimes, narrow permissions, safe storage, and detection.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Use managed secrets: Store credentials in an encrypted secret manager or CI/CD secret facility. Never hard-code them in application source, infrastructure code, tickets, screenshots, or documentation.
- Prefer workload identity or OIDC: For CI/CD and cloud workloads, use short-lived federated identity where supported instead of storing long-lived cloud keys in pipelines.
- Constrain each key: Limit APIs, IP ranges, referrers, applications, audiences, projects, and environments. Issue separate keys per team or application to reduce blast radius and improve attribution.
- Scan before and after push: Enable repository secret scanning and push protection, and scan build logs and artifacts as well as Git history.
- Set review dates: Track owner, purpose, creation date, last use, and planned expiry. Google Cloud’s 90-day guidance for managed service-account keys is a useful baseline for that credential type, not a universal rule for every provider.
- Monitor continuously: Alert on authentication anomalies, unusual request patterns, billing spikes, configuration changes, and credentials that have not been used recently.
- Practice rotation: Test replacement and rollback procedures in a non-production environment so an incident does not become the first time the team attempts them.
What mistakes cause outages during key rotation?
Most failures come from changing the issuer before all consumers are ready or from assuming a single configuration update reaches every process.
- Revoking before inventory: A forgotten worker or vendor integration fails immediately. Fix it by recording every consumer and owner before the change whenever the credential is not being actively abused; during an active attack, revoke first and recover the consumers afterward.
- Updating only the main application: Background jobs, replicas, and deployment pipelines continue using the old value. Search all environments and restart processes that cache secrets.
- Using an unrestricted replacement: The service works, but the blast radius grows. Copy only the permissions and restrictions required by the workload.
- Leaving the old key active indefinitely: The overlap becomes a second permanent secret. Set a short, explicit retirement deadline and monitor for missed consumers.
- Deleting history instead of revoking: Attackers can use copies from clones, forks, logs, or caches. Invalidate the credential at the issuer first.
- Assuming revocation kills issued tokens: Some providers let existing short-lived tokens run to expiry. Communicate that residual window and apply compensating controls.
- Skipping provider logs: A successful deployment does not prove the secret was unused. Review requests, billing, and control-plane events before closing the incident.
How should you document the completed rotation?
Close the incident only after the new credential is deployed everywhere, the old one is disabled or deleted, and monitoring shows no unexpected use. Record the credential identifiers, exact revocation and deletion times, affected systems, observed activity, replacement restrictions, and repository-cleanup actions. Document any tokens that could remain valid until expiry and the time at which that window ends.
Assign an owner for follow-up fixes such as secret scanning, workload identity migration, permission reduction, or pipeline changes. A concise record lets the next responder repeat the process without rediscovering provider-specific behavior.
Frequently Asked Questions
Should I rotate every credential in the same project after one key leaks?
Not automatically. Rotate credentials that were exposed, shared the same storage or account, could be minted or escalated by the compromised key, or show suspicious use; otherwise preserve unaffected credentials and document why they were not changed. Reusing the same secret across applications is a strong reason to expand the rotation scope.
What if the provider offers no overlap between old and new keys?
Stage the replacement in every consumer first, schedule a coordinated deployment, and validate it in a canary or maintenance window. Because the old key cannot serve as rollback after revocation, prepare a separate newly issued fallback and communicate the cutover time.
How can I prove the replacement has the right permissions?
Test both a required operation and a deliberately forbidden operation in a non-production or canary context. Confirm the provider audit event identifies the replacement and that the denied operation fails without triggering broad retries or lockouts.
When is it safe to close the incident?
Close it after all known consumers use the replacement, the old credential is disabled or deleted, residual token lifetimes have elapsed, and log and billing reviews show no unresolved misuse. Keep the incident record and provider audit references even after repository cleanup.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
