# Leaked Deepgram API Key? Delete It and Check Usage > Deepgram API key exposed on GitHub? Create a replacement, delete the leaked key, check project usage and keep speech keys out of code. Step-by-step guide. Source: https://leakwatch.net/secrets/deepgram-api-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Deepgram API Key AI · Secret guide # Leaked Deepgram API Key: what to do in the first hour Medium severityDetected onlyLast verified October 23, 2026 · 5 min read A Deepgram API key lets whoever holds it send audio to Deepgram’s speech services and receive transcripts, and every minute of audio is billed to the project the key belongs to. Keys belong to a project, not to a person, so a leaked key can be used at any time by anyone who has it. Replace the key first, then check the project’s usage, because a stolen speech key can quietly transcribe a large amount of audio for someone else. [Check your GitHub account for leaked secrets — free](/) Provider Deepgram Severity Medium Impact SaaS account access and billing Checked live by LeakWatch No ## What a Deepgram API Key looks like A Deepgram key is a string of 40 characters made of lowercase letters and digits, with no dashes and no prefix: ```text xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Deepgram API key (40 characters, masked) ``` Because there is no prefix, the value on its own says nothing. Its meaning comes from context: a variable such as `DEEPGRAM_API_KEY`, a call to a Deepgram endpoint, or the word `deepgram` near the value in a configuration file. A 40-character lowercase string with no context is not enough to identify the service, so check the surrounding lines before you decide what the key is for. ## How Deepgram API Keys get leaked - **Environment files committed by accident.** A `.env` file or a Docker compose file with the key in plain text and no entry in `.gitignore`. - **Speech sample scripts.** A test script for transcription that was edited to include a real key and then committed with a sample audio file. - **Browser code.** A web app that streams microphone audio straight to Deepgram with a long-lived key, which hands that key to every visitor. Use short-lived tokens or a backend proxy for browser clients. - **CI pipelines.** A key written into a workflow file or printed by a debug step, where it ends up in logs that others can read. - **Shared configuration.** A key copied into a team dotfiles repository, a notebook or an issue thread while someone was debugging an integration. ## What to do in the first hour 1. **Create a replacement key first.** Sign in to the Deepgram Console, open the project that the leaked key belongs to, and create a new key for it. Name the key after the application that will use it. 2. **Deploy the new key** to your secret manager or environment, then send one short test file to confirm the application still works. Keep one key per application so that the next rotation is smaller. 3. **Delete the exposed key.** Use the revocation steps below. Once it is deleted, requests made with it stop working. 4. **Check project usage.** Open the usage and billing views for the project since the exposure. Look for audio hours you do not recognize, for requests at unusual times, and for features you never enable, such as large batch jobs. Usage can lag, so check again later in the day. 5. **Review the project and its members.** Check who has access to the project and remove anyone you cannot place. If the key’s creator has left the team, make sure the replacement belongs to a person who still has access. 6. **Clean the repository.** Remove the value and rewrite history if you want to. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github), and [deep scan your whole git history](/blog/deep-scan-your-whole-git-history) if the value may have been committed earlier. Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Deepgram Keys are listed per project in the Deepgram Console, under the settings area for API keys. Find the key that matches the leaked value, by its name or the characters shown, and delete it. The Deepgram documentation describes deleting a key with a trash icon in that list, and it can also be done through the API or the Deepgram command-line tool, which supports a preview before deletion. Deleting the key is what ends the exposure, so do it as soon as the replacement is in place. You can reach the key list from the API keys page of your console, and if the list does not match what you see here, follow Deepgram’s current documentation. ## How LeakWatch detects it The rule is called Deepgram API Key. It looks for the word `deepgram` in any letter case, followed within about 40 characters by a run of exactly 40 lowercase letters and digits that stands alone between word boundaries. The keyword `deepgram` narrows the search. The distance limit keeps the rule from matching a random 40-character string far from the service name, which lowers false alerts, but it also means a key pasted without the name nearby can be missed. The severity is **medium**. This type is not checked live: LeakWatch does not send any request to Deepgram with the value it found, so a finding does not tell you whether the key still works. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone read my recordings or transcripts with this key? The key is used to send audio and receive transcripts. It does not by itself give access to the transcripts you already have stored, but it can be used to process new audio under your project, and the output returns to whoever made the request. Check what your project stores and whether any stored data is reachable from the project. The key was public for a few minutes. Is that a real risk? Yes. Scanners watch public repositories continuously, and a speech key is easy to use with a simple script. Replace it, and then check usage to see whether it was used. Should I use short-lived tokens in the browser? Yes, when audio comes from a browser or a mobile app. A long-lived key shipped to clients can be copied by anyone, while a short-lived token expires on its own. Keep the long-lived key on your server and issue tokens from there. ## Related - [ElevenLabs API Key](/secrets/elevenlabs-api-key) - [Mistral API Key](/secrets/mistral-api-key) - [Groq API Key](/secrets/groq-api-key) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Deepgram. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)