# Leaked Cohere API Key? Delete It and Check Usage > Cohere API key exposed on GitHub? Delete it in the Cohere dashboard, create a new one, and check usage and billing. Step-by-step guide. Source: https://leakwatch.net/secrets/cohere-api-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Cohere API Token AI · Secret guide # Leaked Cohere API Token: what to do in the first hour High severityDetected onlyLast verified October 19, 2026 · 5 min read A Cohere API key lets whoever holds it call Cohere’s models for text generation, embeddings and reranking, with the usage counted against your account. A trial key is rate limited and not meant for production traffic, while a production key is billed. Neither reaches your servers or your customers. The risk is the bill, the quota you share with your own application, and any data that flows through the calls. Replace the key first, then check how it was used. [Check your GitHub account for leaked secrets — free](/) Provider Cohere Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What a Cohere API key looks like A Cohere key is 40 letters and digits, with no prefix and no separator: ```text …XXXX Cohere API key (masked, 40 letters and digits, no prefix) ``` Nothing in the string says it belongs to Cohere, which is why it is hard to spot on its own. What identifies it is the name of the variable next to it, usually `CO_API_KEY` (the name Cohere’s own SDKs read) or something containing `cohere`, such as `COHERE_API_KEY`. A bare 40-character string found without that context cannot be attributed to Cohere with confidence: a Git commit hash is also 40 characters, although it only uses hexadecimal digits. ## How Cohere API keys get leaked - **Hardcoded in a client call**, such as a client constructed with the key as a string, then committed. - **Environment files** (`.env`, Docker compose files, CI variables) copied into a repository under `CO_API_KEY`. - **Notebooks and tutorials.** Cohere is widely used in retrieval and embedding examples, and a key typed into a cell is saved with the notebook. - **Vector-store and RAG configs.** An ingestion script or framework config that holds the embedding key next to the database credentials. - **Front-end code.** A key placed in JavaScript so a web page can call the API directly. ## What to do in the first hour 1. **Open the API keys page** of the Cohere dashboard and find the exposed key. Note its name, its type (trial or production) and when it was created. 2. **Create a new key** with a name that says which service uses it. One key per service means the next rotation does not take everything down. 3. **Deploy the new key** to the application or secret store, and confirm that an embedding or generation call still works. 4. **Delete the exposed key** from the same page, then retry a call with the old value to check that it is rejected. 5. **Check usage.** Review the usage and billing views of the account for the period since the exposure. Red flags are a volume of embeddings or generations you cannot explain, or spend on a plan you do not use. 6. **Check what else was exposed with it.** If the key sat in a RAG or ingestion project, the same file may also hold a vector database key, a storage credential or a database URL. Rotate each at its own provider. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). 7. **Move the key out of the code** into an environment variable or secret manager, and add the file that held it to `.gitignore`. Want to know what else the same repository exposes? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Cohere Cohere keys are created and deleted from the API keys page of the Cohere dashboard, after you sign in to the account that owns them. Select the exposed key and delete it. If you cannot find it, check the other organizations your login belongs to. A person has not confirmed the exact menu wording for this guide, and dashboards change, so if the page differs from what is described here, look for the section where API keys are listed, and follow Cohere’s documentation. ## How LeakWatch detects it The rule is called Cohere API Token. Because the key has no prefix, the rule does not match a bare string: it requires the word `cohere`, or the variable name `CO_API_KEY`, followed by `=` or `:` and exactly 40 letters and digits, with or without quotes. A little text may sit between the marker and the separator, so names such as `cohere_api_key` or `CO_API_KEY_PROD` are covered, in any letter case. A value of 39 or 41 characters, a bare string, or a key labelled for another provider is not reported. This keeps false alerts down, but it means a Cohere key pasted without its variable name will be missed. The severity is **high**. This type is not checked live: LeakWatch does not send any request to Cohere with the key it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Is a trial key a problem if it leaks? Less than a production key, because trial keys are rate limited and not billed the same way. It still lets a stranger use your quota and see your integration setup, so delete it and issue a new one. I found a 40-character string with no label. Is it a Cohere key? Not necessarily. Look at the code around it for `CO_API_KEY`, a Cohere client or calls to the Cohere API, or compare its last characters with the keys listed in your dashboard. Can someone read my past requests with the key? The key lets a third party make new requests. Whether any past content can be read depends on the features and data settings of your account, so check the dashboard and Cohere’s documentation rather than assuming either way. ## Related - [OpenAI API key](/secrets/openai-api-key) - [Mistral API Key](/secrets/mistral-api-key) - [Hugging Face Access Token](/secrets/huggingface-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Cohere. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)