# Leaked Fastly API Token? Revoke It Now > Fastly API token exposed on GitHub? Delete it in your account, review service history for changed versions and purges, then rotate what it touched. Source: https://leakwatch.net/secrets/fastly-api-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Fastly API Token Cloud · Secret guide # Leaked Fastly API Token: what to do in the first hour High severityDetected onlyLast verified October 23, 2026 · 4 min read A Fastly API token lets whoever holds it call the Fastly API as your account or as a service user. Depending on its scope, that can mean purging cached content, changing the configuration and routing rules of your services, or pointing traffic at a different origin. Traffic control is the real danger: a changed rule can serve visitors content you never published, and the change looks like routine configuration. Delete the token first, then review what changed. [Check your GitHub account for leaked secrets — free](/) Provider Fastly Severity High Impact Cloud infrastructure access Checked live by LeakWatch No ## What a Fastly API Token looks like A Fastly API token is a long random string of lowercase letters, digits, and sometimes underscores, hyphens or equals signs. Fastly shows the value when you create it, and you cannot read it back later. The string alone says little, because a 32-character value of that kind is also a common hash or identifier. What identifies a Fastly token is its context: a variable named `FASTLY_API_TOKEN` or `FASTLY_KEY`, a `Fastly-Key` header sent with a request, or a call to the Fastly API host. Fastly can also issue tokens with a narrower scope, such as read-only or purge-only tokens. Find out which kind leaked. A purge-only token is far less dangerous than a token with full access to your services, but both should be replaced. ## How Fastly API Tokens get leaked - **Purge scripts with the header inline.** A `curl` command that sends the token in a `Fastly-Key` header, committed to the repository. - **Infrastructure code with a literal value.** A Terraform or other provider block that holds the token directly instead of reading it from a variable. - **CI variables echoed in logs.** A build step that prints its environment during debugging. - **Personal tokens in shared places.** A token pasted into a wiki page, a chat thread or a ticket to help someone set up a deployment. - **Dotfiles.** A Fastly CLI configuration file copied into a dotfiles repository that is later made public. ## What to do in the first hour 1. **Create a replacement token first.** In your Fastly account, open the API tokens section. Create a new token with the narrowest scope your scripts need, and give it a name that says which system uses it. 2. **Deploy the new token** to your CI variables, secret manager or local CLI configuration. Run one harmless read command to confirm the pipeline still works. 3. **Delete the exposed token** from the same page. Once it is deleted, any request that still uses the old value fails. 4. **Review service activity.** Open each service the token could reach and look at its version history for the period since the exposure. Look for versions you did not publish, changed backends, new domains, new certificates and unexpected purge requests. 5. **Check user access.** If the token belonged to a person, review the team members and roles on the account and remove anyone who should not have access. 6. **Clean the repository.** Remove the value from the code and from the history. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github), and use [deep scan your whole git history](/blog/deep-scan-your-whole-git-history) to find older copies. 7. **Check the neighbours.** Look at the CI variables and configuration files that sat next to the token for other credentials, and rotate those as well. Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Fastly Open the API tokens page in your Fastly account, find the token by its name and creation date, and delete it. Make sure you are in the right account first. Tokens belong to one account, and a token missing from your list is probably in another one. Once the replacement is deployed, delete the old token and do not keep it “just in case”. After deletion, the old value stops working. ## How LeakWatch detects it The rule is called Fastly API Token. It looks for the word `fastly` in any letter case, followed within about 20 characters by an assignment sign, a colon or an arrow, then an optional quote and a value of exactly 32 characters. Those characters can be letters, digits, underscores, hyphens or equals signs. The label can be any text that contains the word, such as `FASTLY_API_TOKEN`, `fastly_key` or a `Fastly-Key` setting. A 32-character string without the word nearby is not reported, and a shorter value is not reported either. The severity is **high**. This type is not checked live: LeakWatch does not send any request to Fastly with the token it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone change my site with this token? Yes, depending on its scope. A full-access token can change service configuration, upload new versions and purge cache, so treat it as control of your delivery layer. Check the service history before assuming nothing changed. Is a purge-only token as dangerous? Much less. A purge removes cached copies, which slows your site and can add load to your origin, but it does not change what you serve. Replace it anyway, because someone who can purge can also cause an outage. Should I review every token in the account? Yes. List the tokens, check who created each one, and delete any token you cannot tie to a current owner and a current system. ## Related - [AWS access key](/secrets/aws-access-key) - [Cloudflare API Token / Key](/secrets/cloudflare-api-token) - [Vercel API Token](/secrets/vercel-api-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Fastly. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)