Skip to content
KeyDrift
Scan for free
criticalopenai-api-key· OpenAI

OpenAI API key

Billable API access with no test-mode equivalent. A published key is spendable by anyone who reads the bundle, and the spend is billed to your organisation.

How it is detected

Matches the modern `sk-proj-`, `sk-admin-` and `sk-svcacct-` prefixes over the full base64url alphabet, so a key containing `-` or `_` is captured whole rather than truncated at the first one.

If you find one

  1. 1Revoke the key at platform.openai.com/api-keys.
  2. 2Check usage for the billing period — a published key is spendable by anyone who read it, and the charge tends to arrive before any alert does.
  3. 3Put the API call behind a server route with your own rate limiting, so a leaked route costs less than a leaked key.
https://platform.openai.com/api-keys →

Where it turns up

Most often in chat features calling the API directly from a React component.

Fix it in your stack