OpenAI keys are among the most aggressively harvested credentials on Replit, because a working key can be resold or used to generate content at your expense. Attackers often run up hundreds or thousands of dollars before you notice. If your key was in a public Repl or inline in code, revoke it right now.
Why it's a problem
A leaked OpenAI key is money. Bots scan public Repls specifically for these, and once found the key is used immediately to make paid API calls until it is revoked. There is no data breach needed; the bill itself is the damage, and it can be large.
How to fix it, in order
- 1Revoke the key at OpenAI immediately. Delete the exposed key in the OpenAI dashboard and create a new one. This stops the billing damage.
- 2Check your OpenAI usage and billing. Look for a spike in calls or spend you did not make, and set a usage limit while you are there.
- 3Move the key into Replit Secrets. Store it in the Secrets pane, not in code or a committed .env, so forks and viewers cannot read it.
- 4Call the API server-side. Make the OpenAI request from server code so the key is never in client JavaScript.
Why Replit does this
The Replit Agent often generates client-side JavaScript that calls the OpenAI API directly with the key inline, exposing it in the browser. Even when meant to be server-side, the fastest working version can embed the value where it ships publicly.
Stop it happening again
Keep the OpenAI key in Replit Secrets and call the API only from the server. Set a spending limit in the OpenAI dashboard as a safety net. Scan the Repl for any inline key before making it public.
The quick fix
- Revoke the key at OpenAI now; leaked keys are used within minutes.
- Check OpenAI usage and set a spending limit.
- Move the key into the Replit Secrets pane.
- Call the OpenAI API server-side, never from the browser.