A Fastly API token lets whoever holds it call the Fastly API as your account or as a service user. Depending on its scope, that can mean purging cached content, changing the configuration and routing rules of your services, or pointing traffic at a different origin. Traffic control is the real danger: a changed rule can serve visitors content you never published, and the change looks like routine configuration. Delete the token first, then review what changed.
Check your GitHub account for leaked secrets — free
- Provider
- Fastly
- Severity
- High
- Impact
- Cloud infrastructure access
- Checked live by LeakWatch
- No
What a Fastly API Token looks like
A Fastly API token is a long random string of lowercase letters, digits, and sometimes underscores, hyphens or equals signs. Fastly shows the value when you create it, and you cannot read it back later. The string alone says little, because a 32-character value of that kind is also a common hash or identifier. What identifies a Fastly token is its context: a variable named FASTLY_API_TOKEN or FASTLY_KEY, a Fastly-Key header sent with a request, or a call to the Fastly API host.
Fastly can also issue tokens with a narrower scope, such as read-only or purge-only tokens. Find out which kind leaked. A purge-only token is far less dangerous than a token with full access to your services, but both should be replaced.
How Fastly API Tokens get leaked
- Purge scripts with the header inline. A
curlcommand that sends the token in aFastly-Keyheader, committed to the repository. - Infrastructure code with a literal value. A Terraform or other provider block that holds the token directly instead of reading it from a variable.
- CI variables echoed in logs. A build step that prints its environment during debugging.
- Personal tokens in shared places. A token pasted into a wiki page, a chat thread or a ticket to help someone set up a deployment.
- Dotfiles. A Fastly CLI configuration file copied into a dotfiles repository that is later made public.
What to do in the first hour
- Create a replacement token first. In your Fastly account, open the API tokens section. Create a new token with the narrowest scope your scripts need, and give it a name that says which system uses it.
- Deploy the new token to your CI variables, secret manager or local CLI configuration. Run one harmless read command to confirm the pipeline still works.
- Delete the exposed token from the same page. Once it is deleted, any request that still uses the old value fails.
- Review service activity. Open each service the token could reach and look at its version history for the period since the exposure. Look for versions you did not publish, changed backends, new domains, new certificates and unexpected purge requests.
- Check user access. If the token belonged to a person, review the team members and roles on the account and remove anyone who should not have access.
- Clean the repository. Remove the value from the code and from the history. See I accidentally pushed an API key to GitHub, and use deep scan your whole git history to find older copies.
- Check the neighbours. Look at the CI variables and configuration files that sat next to the token for other credentials, and rotate those as well.
Not sure what else leaked? Run a free scan.
Revoke it at Fastly
Open the API tokens page in your Fastly account, find the token by its name and creation date, and delete it. Make sure you are in the right account first. Tokens belong to one account, and a token missing from your list is probably in another one. Once the replacement is deployed, delete the old token and do not keep it “just in case”. After deletion, the old value stops working.
How LeakWatch detects it
The rule is called Fastly API Token. It looks for the word fastly in any letter case, followed within about 20 characters by an assignment sign, a colon or an arrow, then an optional quote and a value of exactly 32 characters. Those characters can be letters, digits, underscores, hyphens or equals signs. The label can be any text that contains the word, such as FASTLY_API_TOKEN, fastly_key or a Fastly-Key setting. A 32-character string without the word nearby is not reported, and a shorter value is not reported either. The severity is high. This type is not checked live: LeakWatch does not send any request to Fastly with the token it found.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Can someone change my site with this token?
Yes, depending on its scope. A full-access token can change service configuration, upload new versions and purge cache, so treat it as control of your delivery layer. Check the service history before assuming nothing changed.
Is a purge-only token as dangerous?
Much less. A purge removes cached copies, which slows your site and can add load to your origin, but it does not change what you serve. Replace it anyway, because someone who can purge can also cause an outage.
Should I review every token in the account?
Yes. List the tokens, check who created each one, and delete any token you cannot tie to a current owner and a current system.