# Leaked Linear API Key? Delete It and Check Activity > Linear API key exposed on GitHub? Delete it in your account settings, create a new one and review issue history for unexpected changes. Step-by-step guide. Source: https://leakwatch.net/secrets/linear-api-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Linear API Key Code & CI · Secret guide # Leaked Linear API Key: what to do in the first hour High severityDetected onlyLast verified October 23, 2026 · 4 min read A Linear API key lets whoever holds it read and change issues, projects and comments as the person who created it. Issue trackers collect more than task names: they hold customer details, incident notes, unreleased plans and links to internal systems. A leaked key therefore exposes information well beyond the tracker itself. Replace the key first, then review what it could have changed. [Check your GitHub account for leaked secrets — free](/) Provider Linear Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What a Linear API Key looks like Linear personal API keys start with the prefix `lin_api_`, followed by 40 letters and digits: ```text lin_api_…XXXX Linear API key (masked) ``` The prefix is specific, so a match is rarely a coincidence. Keys are sent in the `Authorization` header of requests to Linear’s API, which is why the same value often shows up in example requests copied from documentation or from a debugging session. ## How Linear API Keys get leaked - **Sync scripts and bots.** A script that copies issues into a changelog, a status page or a chat channel, with the key written into the code. - **Environment files.** A `.env` file with `LINEAR_API_KEY` committed alongside the rest of the project. - **Example requests.** A `curl` command pasted into a public issue, a blog post or a support thread with the real header still in it. - **CI logs.** A pipeline step that prints the request it makes, or a debug flag that echoes headers. - **Shared scratch files.** A notebook or a snippet saved in a shared folder while someone was testing the API. ## What to do in the first hour 1. **Create a replacement key first.** In your Linear account settings, find the section that lists personal API keys and create a new one. Give it a label that says what uses it. 2. **Update the systems that need it.** Put the new key into the sync script, bot or CI secret store, then run it once to confirm it works. 3. **Delete the exposed key** from the same list. Requests with the old key fail from then on. 4. **Review issue history.** Look at the issues, projects and comments that the key’s owner touched since the exposure. Look for edited or deleted issues, new comments you did not write, changed assignees and due dates, and new projects. 5. **Check integrations and webhooks.** A key can register new webhooks and integrations. Review the workspace’s integration settings and remove any you did not create. 6. **Check sensitive content.** If issues held customer data, credentials or incident details, handle them under your incident process, because they were visible to anyone with the key. 7. **Clean the repository.** Remove the value from the file and rewrite history if needed. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) and [deep scan your whole git history](/blog/deep-scan-your-whole-git-history). Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Linear Personal API keys are listed in your Linear account settings. Open the list of personal API keys, find the key by its label, and delete it. Deleting the key ends its access at once. If the key was used by a bot or an integration that was set up under your name, create the replacement under an account that will still be there when you leave the team, so that the next rotation is not a surprise. ## How LeakWatch detects it The rule is called “Linear API Key”. It looks for the prefix `lin_api_` followed by 40 letters or digits, matched without regard to letter case. The rule does not require a word boundary, so the key is found even when it sits inside a longer string. The severity is **high**. This type is not checked live: LeakWatch does not send any request to Linear with the key it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ What can a Linear API key do? It can do what its owner can do in the workspace. That includes creating, editing and deleting issues the owner has access to, and posting comments. Its reach is limited by that user’s permissions, not by a separate scope. Is an OAuth app token the same as a personal key? No. OAuth tokens belong to an installed app and are revoked through the app’s authorization, not through your personal key list. The rule here covers the personal key format. Do I need to tell my team? If the leaked key could read issues containing customer data or security details, yes. Follow your incident process, and tell the people whose information was in the tracker. ## Related - [GitHub Personal Access Token](/secrets/github-personal-access-token) - [Sentry Access Token](/secrets/sentry-access-token) - [Notion API Token](/secrets/notion-api-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Linear. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)