A Linear API key lets whoever holds it read and change issues, projects and comments as the person who created it. Issue trackers collect more than task names: they hold customer details, incident notes, unreleased plans and links to internal systems. A leaked key therefore exposes information well beyond the tracker itself. Replace the key first, then review what it could have changed.
Check your GitHub account for leaked secrets — free
- Provider
- Linear
- Severity
- High
- Impact
- SaaS account access and billing
- Checked live by LeakWatch
- No
What a Linear API Key looks like
Linear personal API keys start with the prefix lin_api_, followed by 40 letters and digits:
lin_api_…XXXX Linear API key (masked)
The prefix is specific, so a match is rarely a coincidence. Keys are sent in the Authorization header of requests to Linear’s API, which is why the same value often shows up in example requests copied from documentation or from a debugging session.
How Linear API Keys get leaked
- Sync scripts and bots. A script that copies issues into a changelog, a status page or a chat channel, with the key written into the code.
- Environment files. A
.envfile withLINEAR_API_KEYcommitted alongside the rest of the project. - Example requests. A
curlcommand pasted into a public issue, a blog post or a support thread with the real header still in it. - CI logs. A pipeline step that prints the request it makes, or a debug flag that echoes headers.
- Shared scratch files. A notebook or a snippet saved in a shared folder while someone was testing the API.
What to do in the first hour
- Create a replacement key first. In your Linear account settings, find the section that lists personal API keys and create a new one. Give it a label that says what uses it.
- Update the systems that need it. Put the new key into the sync script, bot or CI secret store, then run it once to confirm it works.
- Delete the exposed key from the same list. Requests with the old key fail from then on.
- Review issue history. Look at the issues, projects and comments that the key’s owner touched since the exposure. Look for edited or deleted issues, new comments you did not write, changed assignees and due dates, and new projects.
- Check integrations and webhooks. A key can register new webhooks and integrations. Review the workspace’s integration settings and remove any you did not create.
- Check sensitive content. If issues held customer data, credentials or incident details, handle them under your incident process, because they were visible to anyone with the key.
- Clean the repository. Remove the value from the file and rewrite history if needed. See I accidentally pushed an API key to GitHub and deep scan your whole git history.
Not sure what else leaked? Run a free scan.
Revoke it at Linear
Personal API keys are listed in your Linear account settings. Open the list of personal API keys, find the key by its label, and delete it. Deleting the key ends its access at once. If the key was used by a bot or an integration that was set up under your name, create the replacement under an account that will still be there when you leave the team, so that the next rotation is not a surprise.
How LeakWatch detects it
The rule is called “Linear API Key”. It looks for the prefix lin_api_ followed by 40 letters or digits, matched without regard to letter case. The rule does not require a word boundary, so the key is found even when it sits inside a longer string. The severity is high. This type is not checked live: LeakWatch does not send any request to Linear with the key it found.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
What can a Linear API key do?
It can do what its owner can do in the workspace. That includes creating, editing and deleting issues the owner has access to, and posting comments. Its reach is limited by that user’s permissions, not by a separate scope.
Is an OAuth app token the same as a personal key?
No. OAuth tokens belong to an installed app and are revoked through the app’s authorization, not through your personal key list. The rule here covers the personal key format.
Do I need to tell my team?
If the leaked key could read issues containing customer data or security details, yes. Follow your incident process, and tell the people whose information was in the tracker.