Leaked Doppler API Token: what to do in the first hour

• Environment files committed by accident. A DOPPLER_TOKEN= line in a .env file, a Docker Compose file or a shell script that was never added to .gitignore.
• Hard-coded CLI calls. A deploy script that runs doppler with the token as an argument, which then lands in shell history, process listings and CI logs.
• Build logs. A pipeline step that prints its environment, or a debug flag that echoes the configuration it loaded.
• Shared snippets. A token pasted into a support thread, a gist or a chat to get a setup command to work.
• Forks and mirrors. A repository that was public for an hour and then made private. Automated scrapers copy public commits within minutes, and the copy stays out of reach even after the file is removed.

1. Revoke the token first. Open your Doppler dashboard, go to the personal tokens list for your account and revoke the exposed token. Revocation stops it working immediately, so do it before cleaning the repository.
2. Create a replacement for the tools that still need access. Prefer a service token scoped to one project and config over a personal token, since it can read less.
3. Deploy the replacement to the CI system or server that used the old value, and confirm the application still starts and reads its secrets.
4. Rotate the secrets it could read. Doppler stores the values, so every secret in the affected projects and configs should be treated as seen. Start with production database passwords, cloud keys and payment or email credentials. Rotate them at their own providers, then update Doppler.
5. Check the activity. Look at the audit or activity log in Doppler, if your plan provides one, for the period since the exposure. Look for reads from unfamiliar addresses or at odd hours, and for changes to secrets you did not make. Note that the log may not show everything, so do not treat a clean log as proof.
6. Review workspace access. Check the members of the workspace and remove any account you cannot place. A personal token carries the permissions of the account that created it.
7. Clean the repository and look for other secrets stored next to the token. See I accidentally pushed an API key to GitHub and Deep scan your whole git history.

Not sure what else leaked? Run a free scan.

Personal tokens are listed in your Doppler account settings, on the page for tokens. Find the token that matches the exposed value, using its first and last characters, and revoke it. Service tokens and CLI tokens are managed from the project and config they belong to, so if the leaked value was one of those, go to that project’s access settings instead. Doppler also offers a bulk revocation option for the workspace, which is useful when you cannot tell which token leaked. Use it with care, since it stops every matching token, including the ones your own tools depend on. The wording and layout of the dashboard change over time, so if a menu differs from this description, follow the personal tokens page and Doppler’s current documentation for the steps.

The rule is called Doppler API Token. It looks for the literal prefix dp.pt., followed by 40 to 44 letters or digits, with a word boundary on each side. Because the prefix is fixed and the length is narrow, a match is rarely a coincidence. The rule does not match the service token prefix dp.st. or the CLI token prefix dp.ct., so those need their own check. The severity is critical. This type is not checked live: LeakWatch does not send any request to Doppler with the token it found, so you should treat a detection as a real exposure until you have revoked the token yourself.