# Leaked CircleCI Token? Delete It Now > CircleCI personal API token exposed on GitHub? Delete it in user settings, create a new one and review pipeline activity. Step-by-step guide. Source: https://leakwatch.net/secrets/circleci-personal-access-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. CircleCI Personal Access Token Code & CI · Secret guide # Leaked CircleCI Personal Access Token: what to do in the first hour High severityDetected onlyLast verified October 23, 2026 · 4 min read A CircleCI personal API token acts as you. It can call the CircleCI API with your permissions: read and trigger pipelines, see projects and environment settings in the organizations you belong to, and in many setups change configuration. It is not a deploy key for one project, so a leak reaches everything your account can reach. Delete the token first, then review what your account did while the value was public. [Check your GitHub account for leaked secrets — free](/) Provider CircleCI Severity High Impact Source code and build access Checked live by LeakWatch No ## What a CircleCI Personal Access Token looks like CircleCI personal API tokens start with a fixed prefix, `CCIPAT_`, followed by two blocks of hexadecimal and alphanumeric characters separated by an underscore. Masked, the shape is: ```text CCIPAT_…XXXX CircleCI personal API token (masked) ``` The prefix is specific to CircleCI, so a hit is rarely a false alarm. Do not confuse the personal token with other CircleCI credentials. Project API tokens, context variables and runner resource tokens are created in different places and have different scopes. If the leaked file also contains one of those, handle it as a separate secret. ## How CircleCI Personal Access Tokens get leaked - **Local tooling configuration.** The CircleCI command-line tool or a script stores the token in a file that gets committed with the rest of the project. - **Pipeline definitions.** A token pasted into a configuration file as a variable, instead of being set in the project’s environment settings. - **Scripts that call the API.** A deployment or reporting script that carries the token inline and is then shared with a team. - **Logs and screenshots.** A command that echoes the token, or a settings page captured with the value visible. - **Shared dotfiles.** A personal configuration repository that keeps working credentials alongside harmless settings. ## What to do in the first hour 1. **Delete the exposed token.** Open your user settings in CircleCI, go to the personal API tokens section, and remove the token that matches the leaked value. Deleting it ends its access at once, so do it before any other cleanup. 2. **Create a replacement** if your scripts or tools still need one. Give it a name that says where it is used, and set the shortest expiry date that still works. CircleCI requires an expiry date, which limits how long a leaked token can be abused. 3. **Update the tools and pipelines** that used the old token. Put the new value in the CircleCI project settings or your secret store rather than in a file. 4. **Review pipeline activity.** Look at the pipelines and workflows that ran in the organizations you belong to since the exposure. Look for runs you did not start, changes to configuration, and jobs that used unfamiliar branches or commit messages. 5. **Check project and context settings.** Review environment variables and contexts that the token could read, and rotate any secret that might have been displayed in a job log. 6. **Review organization membership.** Check who has access to the projects and remove anyone who no longer needs it. 7. **Clean the repository.** Remove the value from the file and rewrite history if you want to. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github), and use [deep-scan your whole git history](/blog/deep-scan-your-whole-git-history) to find older copies. Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at CircleCI Open your personal API tokens page in CircleCI user settings. Find the token by its name, which is the label you gave it when you created it, and remove it with the delete control, then confirm. Tokens cannot be edited after they are created, so deleting and creating a new one is the only way to rotate. Tokens issued through an OAuth sign-in flow appear in the same list, and you can delete them there too. Expiry reminder emails stop for a token once it is deleted. ## How LeakWatch detects it The rule is called CircleCI Personal Access Token. It looks for the literal prefix `CCIPAT_`, then exactly twenty-two letters or digits, an underscore, and exactly forty hexadecimal characters, with a word boundary at each end. The prefix is matched in lower case as well. A value that is shorter, longer, or without the right underscore layout is not reported. The severity is **high**. This type is not checked live: LeakWatch does not call the CircleCI API with the value it found, so a finding tells you the value has the right form, not whether it still works. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Will deleting my token stop my pipelines? Only the pipelines that call the CircleCI API with that token, and only until you give them the new value. Pipelines that run normally on commits do not use your personal token. Can someone with my token see my organization's secrets? Possibly. Environment variables and contexts are not shown in full in the API, but the token can change configuration and trigger jobs that read them. Treat any secret those jobs could reach as exposed. How long should the replacement token last? As short as your workflow allows. Short expiry limits the damage if the new value leaks too, and CircleCI sends reminders before a token expires, so a short lifetime is easy to manage. ## Related - [GitHub Personal Access Token](/secrets/github-personal-access-token) - [GitLab Personal Access Token](/secrets/gitlab-personal-access-token) - [Docker Hub Access Token](/secrets/docker-hub-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with CircleCI. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)