What should I do if my AI API key has leaked?
In short: Revoke the key right away, then create a new one and put it into the tools you use. On the Wiozen API that's one click on the Keys page, and from that moment every request made with the revoked key gets 401. Then check that key's spend in the list and give the new key a spend limit.
How do I know a key has leaked?
Wiozen keys start with sk-gw-. If a key made it into a public repository, a forum post, a screenshot or a shared chat, treat it as leaked. Making the repository private afterwards or deleting the file isn't enough: the key stays in the git history, and bots that scan public repositories for keys find it quickly.
The Keys page shows the first 12 characters (the prefix), the label and the total spend so far for every key. Compare the start of the leaked key against those prefixes to find which one it is. A key whose spend goes up at times you aren't using it is also a sign of a leak.
1. Revoke the key
- Open the Keys page in the API dashboard.
- On the leaked key's row, click Revoke and confirm.
- The status column now shows the key as "revoked".
Revoking takes effect immediately. The key no longer passes authentication, and requests made with it are rejected with 401 Invalid API key. You can't undo a revoke or switch the same key back on.
If the key came from Connect account on a WordPress site, its label carries the site address. Revoking it also disconnects the Content Bot on that site; reconnecting the bot creates a new key.
Revoke or delete?
The page has two buttons. Revoke stops the key but leaves its row in the list, so you can still see how much it spent. Delete removes the key from the list for good; it also stops requests, but the per-key spend row goes with it.
After a leak, revoke first. Once you've checked the spending you can delete it later if you want.
2. Create a new key and update your tools
Type a label into the New key box on the same page and create it. The full key is shown only at that moment. Wiozen doesn't store keys in plain text, only a SHA-256 hash and the prefix, so neither you nor support can see the full key later. If you lose it, you create a new one.
Put the new key everywhere the old one was used: the editor extension, the environment variable on your server, your CI secrets. Since the old key is revoked, any tool you forgot gets 401, which is how you find it.
Use a separate key for each tool. When one leaks you only switch that one off, the rest keep working, and you can track spending tool by tool.
3. Check what was spent
The Spend column in the key list shows how much each key has spent so far. The Usage page also breaks recent requests down by model. If either screen shows an increase you didn't expect, note the date and amount and write to support from the support page on account.wiozen.com.
When a request is charged, the amount comes off your balance and is added to that key's spend. Once the balance runs out the API answers with 429, so a leaked key can't spend more than your balance. The real protection is the limit in the next section.
4. Put a spend limit on the new key
Every row on the Keys page has a spend limit box in dollars. Left empty, there's no limit. Enter an amount and save it, and once the key's total spend reaches that amount it rejects new requests with 429 API key spend limit reached and shows as "limit reached" in the list. Your other keys and your balance aren't affected.
The limit isn't monthly and doesn't reset. It applies to the key's total spend since it was created. If you want to keep using a key that hit its limit, raise the limit or remove it.
The limit applies to the chat endpoints and also to image generation, embeddings, text to speech, transcription, web search and page fetch. It's checked when each request starts, so the last request that began just under the limit still finishes, and total spend can go over by the cost of one request.
Pick the limit from the tool's real usage. If a plugin spends a few dollars a month and you give its key a $5 limit, a leak can't cost you more than $5; when the limit fills up, you just raise it.
How do I keep it from happening again?
- Don't write the key into code. Keep it in an environment variable or a
.envfile, and add.envto.gitignore. - Never put a key in code that runs in the browser, in a mobile app bundle or on a public web page. Anything sent to the client can be read; make the request from your own server.
- Check settings screens for keys before you share a screenshot or screen recording.
- Give each tool its own key and a spend limit close to what it actually uses.
Frequently asked questions
Can I switch a revoked key back on?
No. Revoking is permanent. Create a new key and put that into your tools.
Can Wiozen show me my full key again?
No. The full key is shown only when it's created; the system keeps only its hash and its first 12 characters.
Does the spend limit reset every month?
No. It applies to the key's total spend since it was created. When it's reached you can raise it, remove it or create a new key.
What happens when the limit is reached?
Requests made with that key get 429 API key spend limit reached. Your other keys keep working and your balance isn't touched.
Why revoke a leaked key instead of deleting it?
Both stop requests. A revoked key stays in the list so you can still see what it spent; a deleted key's row disappears.
Go to the Keys page now and give every key a label and a spend limit. Revoke the keys you don't use.
More guides: How can you use an AI API from Turkey without a credit card? · How do you connect an OpenAI-compatible API to a tool you already use? · How do you calculate the cost of an AI API? · How do you generate images with an AI API, and what does one image cost? · Why does my AI API return a 429 error, and how do I fix it? · Why do long AI API requests time out: streaming or non-streaming? · Anthropic Messages API or OpenAI Chat Completions: which one should I use? · What is a context window, and what is a 1 million token context good for? · Which AI model should I choose: deciding by price, context and quality · Why does a reasoning model return an empty answer, and why are thinking tokens charged? · Why is my API balance running out faster than expected? Tracking spend request by request · How do you convert a web page to Markdown to feed it to an AI model? · How do you get AI to write and publish articles in WordPress automatically? · How do you find blog topics from RSS feeds and Google Trends? · Does AI-written content show up on Google and in AI answers? · How do you get internal links into AI-written WordPress articles? · How do you get AI to generate a different featured image for every WordPress post? · How do you write a content brief when an AI writes your blog posts? · What should you watch for when an AI writes recipes for your food blog? · How do you fix errors when connecting a WordPress plugin to your AI API account? · Why does my AI article bot stop halfway in WordPress? "Run is stuck" and LiteSpeed · Why are my scheduled WordPress posts late? WP-Cron and a real server cron · How do I get an AI article bot to write blog posts in English or another language? · What does "Content Bot cannot generate articles" mean? Reading the bot's log