# Leaked Artifactory API Key? Revoke It and Audit Access > Artifactory API key exposed on GitHub? Revoke it in your JFrog profile, switch to access tokens and audit downloads and uploads. Step-by-step guide. Source: https://leakwatch.net/secrets/artifactory-api-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Artifactory API Key Code & CI · Secret guide # Leaked Artifactory API Key: what to do in the first hour Critical severityDetected onlyLast verified October 23, 2026 · 4 min read An Artifactory API key lets whoever holds it act as the user it belongs to on a JFrog Artifactory server. Depending on that user’s permissions, that means downloading private packages, uploading artifacts, and in some setups changing repository settings. Artifactory usually holds internal libraries and build outputs, so the risk is twofold: private code can be read, and builds that pull from the repository can be poisoned. Revoke the key first, then check what it touched. [Check your GitHub account for leaked secrets — free](/) Provider Artifactory Severity Critical Impact Source code and build access Checked live by LeakWatch No ## What an Artifactory API Key looks like Artifactory API keys used to start with the literal characters `AKCp`, followed by a long run of letters and digits: ```text AKCp…XXXX Artifactory API key (masked) ``` The rule matches that older format only. JFrog has moved to access tokens and reference tokens, which have a different shape and are not covered by this rule. A leaked credential that does not look like the block above may still be dangerous, so search for the surrounding context, such as the server address or the variable name, and treat it as a secret until you know what it is. ## How Artifactory API Keys get leaked - **Package manager configuration.** `.npmrc`, `pip.conf` and Maven’s `settings.xml` often store Artifactory credentials, sometimes base64-encoded so that the key is not visible at a glance. Committed configuration files are the most common source. - **CLI configuration.** The JFrog CLI keeps its server credentials in a file under the user’s home directory. Copies of that file end up in dotfiles repositories and backups. - **CI variables written into scripts.** A build step that passes the key on the command line, or prints it while debugging. - **Docker and build files.** A key passed as a build argument or left in a Dockerfile or image layer. - **Shared documentation.** A setup guide pasted into a wiki or a public issue with a working key in the example. ## What to do in the first hour 1. **Check the key’s type and replace it.** Sign in to the JFrog Platform and open your user profile. JFrog has stopped issuing new API keys in recent Artifactory versions, so create an access token or reference token from the same profile area instead, and scope it to the repositories it needs. 2. **Update your pipelines and package configs.** Replace the old value in CI, in `.npmrc`, `pip.conf`, `settings.xml` and in any CLI configuration, then run a build to confirm it works. 3. **Revoke the old key** from your profile. Keys do not expire by default, so this step is the only thing that ends them. 4. **Audit requests.** Review Artifactory’s request logs and, if your plan provides it, the Platform audit log, for the period since the exposure. Look for downloads from unknown addresses, uploads you did not make, deletions and permission changes. 5. **Check what the user could reach.** Review the permissions of the user the key belonged to. Any repository that user could write to may contain artifacts you need to check. 6. **Check your builds.** Compare any new or changed artifact with a known-good version or its checksum. An unexpected version of an internal package is a strong sign of tampering. 7. **Clean the repository.** Remove the value from every file, including base64-encoded copies, and rewrite history if needed. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) and [deep scan your whole git history](/blog/deep-scan-your-whole-git-history). Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at JFrog Revoke the key from your user profile on the JFrog Platform, in the section that manages your API key. Administrators can also see which users still hold API keys and revoke them on the user’s behalf, which helps when a leaked key belongs to someone who is not available. Once revoked, the key stops working for every server that accepts it. ## How LeakWatch detects it The rule is called “Artifactory API Key”. It looks for the exact prefix `AKCp`, case-sensitive, followed by exactly 69 letters or digits, with word boundaries on both ends. A value that is longer or shorter than that is not reported. The severity is **critical**. This type is not checked live: LeakWatch does not send any request to JFrog with the key it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Do Artifactory API keys expire? Not by default. An API key stays valid until someone revokes it, which is why revoking the exposed key by hand matters even after you have a replacement. Can someone upload a bad package with this key? Yes, if the user it belongs to has write permission on a repository. That is why the permission review and the artifact check are part of the first hour. Why not just keep the key and rotate it later? A key that has been public can be copied by automated scanners within minutes. Replace it now, then plan a move to access tokens, which can be scoped and given an expiry date. ## Related - [PyPI Upload Token](/secrets/pypi-upload-token) - [npm Access Token](/secrets/npm-access-token) - [GitLab Personal Access Token](/secrets/gitlab-personal-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Artifactory. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)