> AffiliateOS Help Center. Index of every article for AI tools: https://www.affiliateos.ai/help/llms.txt

# If an API key leaks

Account, team and security · For publishers, networks · Updated 30 October 2026
Web version: https://www.affiliateos.ai/help/account/api-key-leaked

Generate a replacement key, revoke the leaked one straight away, then put the new key on your server. Your integration fails for the few minutes between revoking and deploying, which is better than leaving the key open. Publishers then check their postback URLs, because a publisher key can edit them.

## Do this now

### Generate the replacement

Publishers: **My Profile**, then **API Keys**, then **Generate Key**. Networks, signed in as the network's owner (keys and the webhook secret are owner-only): **Workspace settings**, then **API Keys**, then **Generate Key**. Copy the new key: it's shown once. If a network account is at its key limit, remove the leaked key first and generate after.

### Revoke the leaked key

Publishers choose **Revoke** on its row; networks choose **Remove**. Match it by the prefix in the list, the first characters of the key. It stops working at once, except that a publisher key may still read the offer list for up to 30 seconds.

### Deploy the new key

Replace the key wherever your servers read it, then make one call to confirm it answers 200.

### Publishers: check your postbacks

Open **Postbacks** and check every row points at your own server. Delete any row you didn't add. If offer blocking is on for your account, also check no offer was blocked that you didn't block.

### Check it worked

A call with the leaked key now answers 401 with `Invalid or expired API key`, and only the new key shows in your list.

## What a leaked key could reach

| Key | Could | Couldn't |
|---|---|---|
| Publisher key, `pk_` | Read your offer list, reports, conversions and billing. Add, change or delete your postback rows. Block offers from your offer list and wall, if offer blocking is on for your account. | Create, list or revoke keys. Read or replace your [postback secret](https://www.affiliateos.ai/glossary#postback-secret). Add teammates or reset passwords. |
| Network key, `ak_` | Read the offers your network can run, at your rates | Anything else |

A changed row could send your conversions to someone else's server, and your users would go uncredited until you fix it. The key can't read your secret, so nobody can use it to fake postbacks to you.

## If a secret leaks instead

- **Publisher postback secret:** **Postbacks**, then **Rotate secret**. The old secret stops working at once, so update your server straight after, or every postback fails your signature check.
- **Network webhook secret:** **Workspace settings**, then **Revoke** beside the secret, then **Generate Webhook Secret**, and update your server.

> **Keep keys on your server.** Never put an API key in an app, a web page or a public repository. Anyone who can read the key can call our API as you.

## Tell us

[Contact support](https://www.affiliateos.ai/contact?topic=support) with your account email, the leaked key's prefix, and when and where it was exposed. Never send the full key.