# Leaked Dynatrace API Token? Revoke It Now > Dynatrace API token exposed on GitHub? Delete it, check audit and access events, and rotate the credentials your monitoring can reach. Step-by-step guide. Source: https://leakwatch.net/secrets/dynatrace-api-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Dynatrace API Token Cloud · Secret guide # Leaked Dynatrace API Token: what to do in the first hour Critical severityDetected onlyLast verified October 23, 2026 · 5 min read A Dynatrace API token lets whoever holds it call the Dynatrace REST API for your environment, with exactly the scopes that were ticked when the token was created. Depending on those scopes, that can mean reading metrics, logs and topology, changing monitoring configuration, or pushing data in. Some scopes are broad enough to change settings that affect alerting, so a token can quietly switch off the signals you rely on. Revoke the token first, then check what it could reach. [Check your GitHub account for leaked secrets — free](/) Provider Dynatrace Severity Critical Impact SaaS account access and billing Checked live by LeakWatch No ## What a Dynatrace API Token looks like A classic Dynatrace API token has three parts separated by dots. It starts with `dt0c01`, followed by a 24-character public identifier and a 64-character secret. The masked shape looks like this: ```text dt0c01.XXXX…XXXX.XXXX…XXXX Dynatrace API token (masked) ``` The public identifier is safe to show in a list of tokens, but the secret is the part that grants access. The `dt0c01.` prefix is fixed and case sensitive, so an uppercase variant is not the same string. Dynatrace uses other prefixes for its other token types, such as platform tokens and personal access tokens. This guide covers the `dt0c01` format only, and those other types need to be checked against their own documentation. Note which one leaked, because each is revoked in a different place. ## How Dynatrace API Tokens get leaked - **Agent and integration configuration.** A OneAgent, ActiveGate or Kubernetes manifest that holds the token directly instead of referring to a secret, then gets committed to a repository. - **Automation scripts.** A script that calls the API with `Authorization: Api-Token` and the value written inline, which then sits in a shared repository. - **Infrastructure as code.** A Terraform or Helm file with the token set as a variable default, pushed with the rest of the code. - **Build and deploy logs.** A step that prints request headers while debugging a failed call to the API. - **Support and chat.** A token pasted into a ticket or a thread so that someone else could reproduce a problem. ## What to do in the first hour 1. **Delete the exposed token first.** Open the Access tokens page in your Dynatrace environment and delete the token that leaked. Revocation stops it working immediately, so do it before cleaning the repository. 2. **Create a replacement** with only the scopes the integration needs. Give it a name that says what uses it, so the next review is easier. 3. **Deploy the replacement** to the pipeline, agent or script that used the old value, and confirm that data still reaches the environment. 4. **Check the audit trail.** Dynatrace records changes to settings, so review the audit log for the period since the exposure. Look for configuration changes you did not make, especially alerting profiles, maintenance windows, and anything that mutes or reroutes notifications. Changes of this kind are the most common way a monitoring token is used to hide an intrusion. 5. **Review what the token could read.** Metrics and logs can contain customer data, hostnames and internal URLs. Decide what was visible through the token’s scopes and whether any of it needs to be reported under your own policies. 6. **Check the monitored hosts and integrations.** If the token could change ActiveGate or extension settings, review those settings and remove anything you do not recognize. 7. **Clean the repository** and look for other credentials stored alongside the token. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) and [Deep scan your whole git history](/blog/deep-scan-your-whole-git-history). Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Dynatrace Classic API tokens are listed on the Access tokens page of your Dynatrace environment, which you reach from the settings menu. Find the token by its name or its public identifier, which is the first part after the prefix, and delete it. Personal access tokens are listed under the user menu, so check there if the value was created by a person rather than an integration. Dynatrace documents the steps for each token type, and the menu wording can change, so if the page you see differs from this description, follow Dynatrace’s API documentation for the current steps. ## How LeakWatch detects it The rule is called Dynatrace API Token. It looks for the exact, case sensitive prefix `dt0c01.`, then 24 letters or digits, a dot, and 64 letters or digits, with a word boundary on each side. The lengths have to be exact: a value that is one character short in either part is not reported. The severity is **critical**. This type is not checked live: LeakWatch does not call Dynatrace with the token it found. A detection is therefore a strong signal of exposure, and you should treat it as real until you have revoked the token and reviewed the audit log. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone change my alerting with this token? Yes, if the token has scopes for settings. Changes to alerting profiles and notification rules can hide problems, so review the audit log for those changes first. The token only had read access. Do I still need to revoke it? Yes. Read access can expose hostnames, logs and internal URLs, and you cannot know what else was copied. Revoking costs a few minutes, and the scope of a token can change later without you noticing. Will revoking the token break my monitoring? Until the replacement is deployed, anything that used the old token will stop sending or reading data. Prepare the new token and the deployment first, then revoke, unless the token is being abused right now. ## Related - [Datadog Access Token](/secrets/datadog-access-token) - [Sentry Access Token](/secrets/sentry-access-token) - [GitHub Personal Access Token](/secrets/github-personal-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Dynatrace. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)