# Leaked LaunchDarkly Access Token? Revoke It Now > LaunchDarkly access token exposed in code? Delete it in Authorization settings, create a replacement and check the audit log for flag changes. Source: https://leakwatch.net/secrets/launchdarkly-access-token --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. LaunchDarkly Access Token Code & CI · Secret guide # Leaked LaunchDarkly Access Token: what to do in the first hour High severityDetected onlyLast verified October 23, 2026 · 5 min read A LaunchDarkly access token lets whoever holds it call the LaunchDarkly REST API as your account, with the permissions of the role it was given. Depending on that role, the holder can read and change feature flags, targeting rules, projects and environments. With an admin or writer role, they can change what your production users see and which code paths run. A stolen token therefore changes live behavior, not only data. Replace the token first, then check what it changed. [Check your GitHub account for leaked secrets — free](/) Provider LaunchDarkly Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What a LaunchDarkly Access Token looks like LaunchDarkly access tokens are long random strings. LeakWatch does not rely on a fixed prefix for this one. It relies on context: the word `launchdarkly` sits on the same line as an assignment, and a 40-character value follows it. In a file it usually looks like this: ```text LAUNCHDARKLY_API_KEY=…XXXX LaunchDarkly access token (masked) ``` The variable name does not have to be exactly this. Any name containing `launchdarkly` followed by an equals sign, a colon or a similar assignment operator is enough for the rule to fire. Other LaunchDarkly credentials, such as SDK keys used by your applications, are configured in a different place. If you are not sure what a value is, open the token list in LaunchDarkly and check the name of the match before you act on it. ## How LaunchDarkly access tokens get leaked - **Scripts with the token inline.** A deployment or flag-cleanup script that calls the REST API with the token typed into the code and committed. - **Environment files.** A `.env` file or a CI variables file that was committed because it was not in `.gitignore`. - **Infrastructure code.** A Terraform configuration that uses the LaunchDarkly provider with the token written into a provider block or a variables file in the repository. - **Pipeline logs.** A debug step that prints its environment, or a `curl` command echoed with its `Authorization` header. - **Pasted snippets.** A token copied into a ticket, a chat thread or a public gist to get help with a failing flag call. ## What to do in the first hour 1. **Create a replacement token first.** In LaunchDarkly, open Organization settings from the gear icon, go to the Authorization page and its Tokens tab, and create a new token. Name it after the place where it will be used, and give it the lowest role that still works. 2. **Deploy the new token** to your CI variables, secret manager or Terraform configuration. Run one read request and, if you can, one flag change in a test project, to confirm the new value works. 3. **Delete the exposed token** from the same Tokens tab, using the overflow menu on its row. Calls made with the old value fail once it is deleted. 4. **Review the audit log.** LaunchDarkly records changes to flags, projects, environments and members. Filter to the period since the exposure. Look for changes you did not make, new members, new or edited integrations and webhooks, and flags switched on or off in production. 5. **Check what the token could change.** A token with a writer or admin role could have altered targeting for real users. Compare the current state of your production flags with your last known good state. 6. **Check the other tokens and members.** Review the token list for any token you cannot assign to an owner, and review organization members and their roles. Personal access tokens belong to a member and stop working when that member leaves the team. 7. **Then clean the repository.** Remove the value from the code and rewrite history if you need to. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github), and use [deep scanning of your whole git history](/blog/deep-scan-your-whole-git-history) to find older copies. Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at LaunchDarkly Open the Authorization page in your organization settings, go to the Tokens tab, find the token by its name, and delete it with the overflow menu. If you are not sure which organization the token belongs to, check each one you have access to, since the same name can appear in more than one. LaunchDarkly also offers a reset option on the Authorization page for tokens that were exposed. Use the delete action when you already created a replacement, because a reset issues a new value that you still have to deploy. ## How LeakWatch detects it The rule is called LaunchDarkly Access Token. It looks for the word `launchdarkly` on a line that also contains an assignment, such as `=`, `:` or `=>`. It allows some other characters around the word, then reads exactly 40 characters made of lowercase letters, digits, `=`, `_` and `-`. A value of a different length, or one that is far from the word, is not reported. The severity is **high**. This type is not checked live: LeakWatch does not send any request to LaunchDarkly with the value it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone change my feature flags with this token? Yes, if its role allows it. A reader role can only read, but writer and admin roles can change flag targeting and so change what production users get. Check the role on the token before you decide how urgent the review is, and then check the audit log. Does a personal token need the same response as an organization token? Yes. Both act with the permissions of their role. A personal token belongs to one member, so the owner is easy to find and it is deactivated when that member is removed. Revoke whichever one leaked, and then check the account it came from. Will deleting the token break my applications? Not if they connect with SDK keys, which is how application SDKs normally connect. Deleting the access token breaks what calls the REST API with it, such as scripts, dashboards and Terraform runs. Deploy the replacement to those first, so the deletion costs you little time. ## Related - [GitHub Personal Access Token](/secrets/github-personal-access-token) - [GitLab Personal Access Token](/secrets/gitlab-personal-access-token) - [Datadog Access Token](/secrets/datadog-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with LaunchDarkly. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)