Security · fixes · 2026-10-23

Gemini API key reported as leaked? Rotate, cap, find the leak

As of 24 October 2026. Google and OpenAI update their key policies often, so check the linked pages before you act.

This guide pairs with Ship-Ready AI Rules, and if you want the next step, read Claude weekly limit reached? Why it burns fast + what to do.

Gemini API key "reported as leaked": rotate it, cap spend, and find the leak

Google's troubleshooting page lists this error with a 403 PERMISSION_DENIED status:

Your API key was reported as leaked. Please use another API key.

Google adds: "If your key is known to be leaked, you can no longer use that key with the Gemini API" (Gemini API troubleshooting). Some developers only find out from a bill. One Ask HN post this week was titled "My Gemini bill shot up suddenly to 2500 USD in one day" (Hacker News, 20 Oct 2026). Here's what to do.

Quick fix: the first 15 minutes

Google's own leak checklist (Using Gemini API keys) is the order to follow:

Generate a new key in Google AI Studio.
Update your app to use it, from an environment variable or secret store, never from code.
Disable or delete the old key. Google says: "Do not delete the old key until the new key is fully active."
Audit usage for unexpected spikes or unfamiliar API calls.
Set budget alerts on the billing account, and restrict the new key (see the FAQ).
If you were charged, Google's troubleshooting page says to "Submit a billing support case" for "Unexpected charges due to vulnerability".

Don't keep retrying the old key. Google lists 403 among errors you shouldn't retry.

Why Google flagged your key

Google says its new auth keys "provide fast-acting leaked key enforcement that quickly stops the usage of leaked keys detected by our systems", and new keys made in AI Studio are auth keys from 28 May 2026 (Using Gemini API keys). The same page says the Gemini API rejects requests from unrestricted standard keys. In short, Google found your key somewhere public and turned it off. That stops new usage on that key. It doesn't tell you where else the key was copied, so find the source next.

Find the leak

Your repo and its history

Google says: "Never check API keys into source control systems like Git." Deleting the line in a new commit doesn't remove it from history. Search every commit for the leaked key itself (or, for older standard keys, the AIza prefix shown in Google Cloud's API key docs; newer auth keys may not use it):

git log -p --all -S 'PASTE_THE_LEAKED_KEY'
git log -p --all -S 'AIza' | grep -n 'AIza'

Rewriting history (for example with git filter-repo) and force pushing removes it from your copy. Back up the repo first and warn collaborators, because a force push overwrites the remote history they work from. Assume anyone could have copied it already. Rotating the key is the step that matters, because history rewrites don't reach copies others already made.

Front-end bundles and NEXT_PUBLIC_

In Next.js, any variable prefixed NEXT_PUBLIC_ is "inlined into any JavaScript sent to the browser" (Next.js environment variables docs). A Gemini key there is public. Search your built output (.next/static or dist) for AIza, and move Gemini calls to a server route.

Scripts, notebooks, and shared files

Check notebooks with saved outputs, gists, pasted logs, Docker images, CI logs, and screenshots.

Same steps for an OpenAI key

OpenAI says: "If you believe your key has been leaked, rotate your key immediately from the API Keys page" (Best practices for API key safety). It also advises never deploying keys in client-side environments, never committing keys to a repository, and using the OPENAI_API_KEY environment variable. On spend, it notes that "Spend alerts alone don't stop API traffic", so set a monthly spend limit with hard enforcement too. For per-user caps in your own app, see per-user OpenAI and Anthropic spend limits in Next.js.

Stop your AI agent putting keys in client code

Coding agents often reach for NEXT_PUBLIC_ because it "just works" in the browser. Add a rule to your CLAUDE.md, AGENTS.md, or Cursor rules that AI API keys stay in server code and server environment variables only, and review diffs that touch .env or client components. The same mistake with Supabase is covered in Supabase service role key exposed. Use the AI API cost calculator to work out a sensible budget alert.

FAQ

Will Google refund charges from a leaked key?

We can't promise that. Google's guidance is to submit a billing support case for unexpected charges.

Does deleting the key stop charges immediately?

Once a leak is detected, Google says the key can no longer be used with the Gemini API. Usage already made can still be billed, and Google doesn't give a timing for when deletion takes effect, so also check billing reports and alerts.

What is an auth key?

It's Google's newer Gemini key type with fast-acting leaked key enforcement. New AI Studio keys are auth keys from 28 May 2026.

Can I restrict a key to one API?

Yes. Google's key page describes "Restrict to Gemini API only" in AI Studio, and IP address restrictions in the Google Cloud console.

How do I find a leaked key in git history?

Search all commits for the key string with git log -p --all -S (and AIza for older standard keys), then rotate the key whether or not you rewrite history.

Is NEXT_PUBLIC_ safe for API keys?

No, not for secret keys. NEXT_PUBLIC_ values end up in the browser bundle.

Keep keys out of client code next time

Disclosure: this is our own paid product.

AI Rules ($19 plus VAT where applicable) is a rules and hooks pack for Claude Code and Cursor, with an AGENTS.md for Codex, built for Next.js, Supabase, and Stripe apps. Its hooks are designed to refuse .env reads, printing secret environment variables, and server secrets in client components. It's a safety net, not a sandbox. It won't rotate a leaked key, cap your Google bill, or get you a refund, so do the steps above first. For spend caps inside your own app, we also have a Spend Caps Kit.

Sources checked 24 Oct 2026: ai.google.dev/gemini-api/docs/troubleshooting; ai.google.dev/gemini-api/docs/api-key; help.openai.com/en/articles/5112595-best-practices-for-api-key-safety; nextjs.org/docs/app/guides/environment-variables; cloud.google.com/docs/authentication/api-keys; news.ycombinator.com/item?id=50168795.

Gemini and Google AI Studio are trademarks of Google LLC. OpenAI is a trademark of OpenAI. Claude and Claude Code are trademarks of Anthropic PBC. Cursor is a trademark of Anysphere Inc. Next.js is a trademark of Vercel, Inc. Stack & Ship is not affiliated with or endorsed by them.