A Heroku API key authenticates the Heroku Platform API and the heroku command line as the account that created it. The holder can list your apps, read and change config vars, scale dynos, add or remove add-ons and run one-off commands. Config vars are where apps keep their database URLs and third-party keys, so a leaked Heroku key often exposes more than Heroku. Revoke it first, then read what it could reach.
Check your GitHub account for leaked secrets — free
- Provider
- Heroku
- Severity
- Critical
- Impact
- Cloud infrastructure access
- Checked live by LeakWatch
- No
What a Heroku API key looks like
Recent Heroku authorization tokens start with the fixed prefix HRKU-AA, followed by 58 characters made of letters, digits, dashes and underscores:
HRKU-AA…XXXX Heroku API key, version 2 (masked, 65 characters in total)
This is the newer format that replaced the older bare UUID keys. The prefix makes it easy to attribute: a string starting with HRKU-AA belongs to Heroku. Older tokens were plain UUIDs with no prefix, and LeakWatch handles them in a different rule, so a UUID-shaped key will not be reported under this one.
How Heroku API keys get leaked
- CI secrets in plain text.
HEROKU_API_KEYwritten directly in a workflow file or a deploy script. - Netrc files. A
.netrcfile created byheroku login, copied into a repository or a container image. - Docker images and dotfiles. A token baked into an image layer or synced through a public dotfiles repository.
- Build logs. A debug trace of a deploy script printing the environment.
- Support threads. A key pasted into an issue or a chat to explain a failing release.
What to do in the first hour
- Identify the authorization. Tokens in this format are authorizations of your account. In the dashboard, open your account settings and the applications section to see the authorizations that exist, or list them with
heroku authorizationsfrom the command line. - Create a replacement for the pipeline that used the old one, for example with
heroku authorizations:create, and give it a description and a limited lifetime if your policy allows. - Update your CI with the new value and confirm that a deploy works.
- Revoke the exposed authorization. Use the dashboard, or
heroku authorizations:revokewith the ID of the leaked one. Requests with a revoked token are rejected. - Review what changed. Check the activity feed of each app for releases you did not make, changed config vars, new collaborators, added add-ons and new domains.
- Rotate the config vars. Treat each secret in the config of reachable apps as exposed: database credentials, API keys and session secrets. Rotate them at their own provider, then set the new values.
- Look at the rest of the file. See I accidentally pushed an API key to GitHub.
Not sure what else leaked from the same repository? Run a free scan.
Revoke it at Heroku
Heroku manages these tokens as authorizations of your account. Sign in, open your account settings, and look in the applications section for the authorization to revoke; the command line offers the same through its authorizations commands. Heroku’s documentation also describes regenerating the account API key from the settings page, which invalidates the previous one. Because the exact layout of the settings page can change, look for the section that lists your authorizations and API key. If the leaked token was created by a teammate, they have to revoke it from their own account.
How LeakWatch detects it
The rule is called Heroku API Key V2. It looks for the fixed prefix HRKU-AA followed by exactly 58 characters of the token alphabet, delimited by a quote, a space, a line end or a semicolon. The prefix is distinctive enough that false alerts are rare. The severity is critical, because config vars and release rights usually lead to production data. This type is not checked live: LeakWatch does not test the value against Heroku, so a finding means the string was seen, not that it still works. Look at your authorizations to see whether it is active.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Can someone read my database password with this key?
They can read the config vars of every app the account can access, and Heroku stores a Postgres add-on’s connection string there. Rotate the database credentials after revoking the key.
What about my older UUID-style Heroku key?
It is a different format, handled by a separate rule. Regenerating the account API key from your account settings makes the older value stop working.
The key sat in a private repository. Do I still need to act?
If anyone beyond you can read the repository, its forks or its CI logs, yes. Revoking is quick, and you avoid finding out later that a release was not yours.