Leaked MiniMax API Key: what to do in the first hour

• Coding-agent and editor configs. The subscription key is the one people paste into coding agents and editor plugins. Their settings files, and MCP configuration, then land in a public dotfiles repository.
• Environment files. .env files, Docker compose files and notebook configs copied into a repository, typically under a name like MINIMAX_API_KEY.
• Hardcoded in a script. A quick client call with the key inline, committed as is.
• Browser code. A key placed in front-end JavaScript so that a web page can call the API directly. MiniMax’s own guidance is to keep the key out of client-side code.
• Tutorials and shared notebooks. A key pasted in a Colab notebook, a gist, an issue or a screenshot while asking for help.

1. Work out which key it is. A key starting with sk-cp- is a subscription key. Compare its last characters with what your account shows under Billing, M Plan and under Account, API Keys.
2. Replace it. For a pay-as-you-go key, create a new one under Account, API Keys and delete the old one from the same list. For a subscription key, check the M Plan page for an option to reset or regenerate it. I could not find a documented way to delete a subscription key, so if the page offers none, contact MiniMax support with the last characters of the key and ask for it to be invalidated.
3. Deploy the new key to every tool and application that used the old one, and confirm they still work. A coding tool that keeps working with the old key means the old key is still alive.
4. Check usage. Look at your usage and billing pages for the period since the exposure: requests you cannot explain, models you do not use, a plan allowance or credit balance that dropped faster than usual.
5. Look at your plan. If the key was a subscription key, check the seats and credits attached to the plan and compare them with what you expect.
6. Look for other keys in the same place. A configuration that held a MiniMax key often holds other providers’ keys. Rotate each of them at its own provider.
7. Move the key out of the code. Read it from an environment variable or a secret manager, keep it out of the browser, and remove the old value from the repository. See I accidentally pushed an API key to GitHub.

Not sure what else leaked from the same repository? Run a free scan.

MiniMax keys are managed from the account on the MiniMax platform: Account, API Keys for pay-as-you-go keys, and Billing, M Plan for the subscription key. Sign in with the account that owns the key. The platform’s documentation says MiniMax may disable a key that has leaked publicly, but it does not describe a manual delete step for every key type, so this guide does not claim one. Use the key list where it offers a delete or reset action, and support where it does not. Menu names change, so if the wording differs, look for the section where keys are created and listed.

The rule is called MiniMax API Key. It matches the sk-cp- prefix followed by at least 100 characters, as a whole word, with the severity set to high. The prefix is sensitive to case and the generic OpenAI rule excludes it, so the key is not reported twice. This type is checked live: LeakWatch sends the smallest possible chat request, limited to a single output token, to see whether MiniMax still accepts the key. It reads none of your data.