Accidentally pasted an API key into ChatGPT? Do this now

If a real API key, token, or password landed in ChatGPT, Gemini, Claude, or another AI chat, treat it as exposed. Deleting the message is not enough. Follow this order.

Step 1 — Invalidate the credential

1. Open the provider console (OpenAI, AWS, GitHub, Stripe, Slack, Google Cloud, etc.).
2. Revoke, delete, or rotate the key you pasted.
3. Create a new key with the smallest permissions required.
4. Update only the real systems that need the new key (apps, CI, secret manager).

Step 2 — Check for misuse

• Usage / billing dashboards for unexpected spikes
• Audit logs and recent API activity
• Repos, shells, tickets, and notes for leftover copies of the old key

Step 3 — Clean the surfaces you control

• Delete or edit the AI chat if the product allows it
• Clear clipboard history tools if they stored the secret
• Remove the key from screenshots, Slack, email drafts, and docs

Step 4 — Prevent the next paste

Most leaks are muscle memory: copy a key, switch tabs, paste into AI. Install SafePrompt so known key patterns are redacted to [API_KEY] before you send.

• Use placeholders in prompts: YOUR_API_KEY_HERE
• Never paste a full production .env
• Prefer test/sandbox keys when asking AI for help

FAQ

Is deleting the ChatGPT message enough?

No. The text may already have been processed or stored under the provider’s policies. Rotate the key.

What if it was only a test key?

Still rotate if it can bill or access anything real. Test keys become habits.

Can SafePrompt undo a leak that already happened?

No. SafePrompt helps stop the next accidental paste. Rotation fixes the current leak.