Leaked AssemblyAI API Key? Delete It Now

An AssemblyAI API key lets whoever holds it submit audio for transcription and read the transcripts that come back, and the usage is billed to the account that owns the key. The key sends the request as your account, so a leaked key can transcribe recordings you never sent and can make your account’s transcript history reachable through the API. Replace the key first, then review what was processed while it was exposed.

Check your GitHub account for leaked secrets — free

Provider: AssemblyAI
Severity: Medium
Impact: SaaS account access and billing
Checked live by LeakWatch: No

What an AssemblyAI API Key looks like

An AssemblyAI key is a string of 32 characters made of lowercase letters and digits, with no dashes and no prefix:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx   AssemblyAI API key (32 characters, masked)

Without a prefix, the value on its own is not enough to identify the service. The meaning comes from the context around it: a variable such as ASSEMBLYAI_API_KEY, a call to an AssemblyAI endpoint, or the word assemblyai close to the value in a file. A 32-character lowercase string that appears in a file with no reference to the service is not a reliable finding, so read the surrounding lines before you act on it.

How AssemblyAI API Keys get leaked

Environment files committed by accident. A .env file with ASSEMBLYAI_API_KEY that was never added to .gitignore.
Transcription scripts. A sample script that was edited to include a real key and committed with the audio files it processes.
Browser and mobile apps. A client that sends audio to AssemblyAI with the account key, which hands that key to every user of the app. Requests should go through your backend, or use a temporary token issued by your server.
CI and deployment configuration. A key written into a workflow file, a container image or a deployment manifest that others can read or pull.
Notebooks and shared snippets. A key pasted into a notebook or a chat thread while someone was testing a transcript request.

What to do in the first hour

Create a replacement key first. Sign in to the AssemblyAI dashboard and create a new API key in the workspace or project that the leaked key belongs to. Name it after the application that will use it.
Deploy the new key to your secret manager or environment, then submit one short test file to confirm the application still works. Keep one key per application so the next rotation is smaller.
Delete the exposed key. Use the revocation steps below. Requests made with a deleted key fail, so make sure nothing still depends on it.
Check usage. Open the usage view for the account for the period since the exposure. Look for audio hours you do not recognize, for jobs at unusual times and for features you do not use, such as speaker labels or language detection on recordings you never sent.
Review the transcripts. Look at the transcript list for recordings you do not recognize. If your application stores transcripts, check whether a new job could have read older ones through the same account.
Review access. Check which people and integrations have access to the workspace, and remove any you cannot place.
Clean the repository. Remove the value and rewrite history if you want to. See I accidentally pushed an API key to GitHub, and deep scan your whole git history if the value may sit in an older branch.

Not sure what else leaked? Run a free scan.

Revoke it at AssemblyAI

API keys are managed in the AssemblyAI dashboard, under the workspace settings, in the area for managing API keys. Open the API keys page, find the key that matches the leaked value, and delete it. The AssemblyAI documentation describes locating the key in that list and clicking Delete. If you use projects, keys sit inside a project, so open the right project first. A deleted key stops working for new requests. If the key is no longer in the list but requests still succeed with it, contact AssemblyAI support and tell them which key was exposed.

How LeakWatch detects it

The rule is called AssemblyAI API Key. It looks for the word assemblyai in any letter case, followed within about 40 characters by a run of exactly 32 lowercase letters and digits that stands alone between word boundaries. The keyword assemblyai narrows the search. The distance limit keeps the rule from matching a random 32-character string far from the service name, which lowers false alerts, but a key pasted without the name nearby can be missed. The severity is medium. This type is not checked live: LeakWatch does not send any request to AssemblyAI with the value it found, so a finding does not show whether the key is still active.

LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.

FAQ

Can someone read my transcripts with this key?

Possibly. A key authenticates requests as your account, and the transcript endpoints respond to the account that owns the key. An attacker who has the key may be able to read transcripts that your account has stored, as well as submit new audio. Review what your account keeps, and treat any stored recordings as exposed until you have checked.

Does the key expire on its own?

Not in the way a temporary token does. A standard account key stays active until you delete it. That is why you should replace it now rather than waiting.

Should browser or mobile apps use this key directly?

No. A key shipped to a client can be copied by anyone who uses the app. Send audio through your own backend, or have the backend issue a temporary token for the client to use for a short time.