---
title: "Leaked credentials: sent a key to an example domain?"
description: "Keys, tokens or passwords sent to example-petstore.com reached the wrong server. Revoke and replace them, with links to GitHub, AWS, Stripe and more."
url: https://example-petstore.com/guides/leaked-credentials
language: en
---

# Leaked credentials: what to do now

If your code sent a key, token, password or session cookie to example-petstore.com or example-commerce-host.com, it reached a server you do not control. Treat it as exposed and replace it. Only the service that issued it can revoke it.

## Do this now

1. **Revoke** the key, token or password at the service that issued it. Deleting it from your code is not enough.
2. **Issue a new one** and store it in configuration or a secrets manager, not in code or version control.
3. **Correct the address** in your code first, so the new credential only goes to the real service.
4. **Review** the service’s access logs or audit log for activity you do not recognise since the first request to the example domain.
5. If real card details were sent, **contact the card issuer**.

## Revoke by provider

| Provider | What to revoke | Where |
| --- | --- | --- |
| GitHub | Personal access tokens | [Managing your personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) |
| Google Cloud | API keys, service account keys | [Manage API keys](https://docs.cloud.google.com/docs/authentication/api-keys) · [Respond to compromised credentials](https://docs.cloud.google.com/docs/security/compromised-credentials) |
| AWS | IAM access keys | [Manage access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) |
| Stripe | Secret and restricted keys | [API keys](https://docs.stripe.com/keys) |
| Slack | Bot and user tokens | [auth.revoke](https://docs.slack.dev/reference/methods/auth.revoke/) |
| Anthropic | API keys | [API key best practices](https://support.claude.com/en/articles/9767949-api-key-best-practices-keeping-your-keys-safe-and-secure) |
| OpenAI | API keys | [Best practices for API key safety](https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety) |
| Other services | Any key, token or password | The security or API settings of that service; search its documentation for “revoke” or “rotate”. |

## Afterwards

- Remove the old credential from repositories, logs and configuration history. Rewriting history does not make it safe again; revoking does.
- Turn on secret scanning in your repositories, for example GitHub secret scanning, so leaked keys are reported early.
- Add a check that stops example addresses from reaching production. See [configuring API clients and SDKs](https://example-petstore.com/guides/api-base-url).

Committed the key to Git as well? [Removing a secret from Git history](https://example-petstore.com/guides/remove-secrets-from-git)

## Sources

- [Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) OWASP
- [Secret scanning](https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning) GitHub Docs