# Leaked MiniMax API Key? Replace It and Check Usage > MiniMax key (sk-cp-…) exposed on GitHub? Replace it, check usage and your plan, and clean up. Step-by-step guide. Source: https://leakwatch.net/secrets/minimax-api-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. MiniMax API Key AI · Secret guide # Leaked MiniMax API Key: what to do in the first hour High severityChecked liveLast verified October 19, 2026 · 5 min read A MiniMax key lets whoever holds it call MiniMax’s models and have the usage counted against your account: your pay-as-you-go balance, or the credits and seats of your subscription plan. It does not read your data and does not reach your servers. The risk is spending and abuse. MiniMax says it may disable a key it sees leaked publicly, but you should not wait for that: replace the key yourself and then look at what was used. [Check your GitHub account for leaked secrets — free](/) Provider MiniMax Severity High Impact SaaS account access and billing Checked live by LeakWatch Yes ## What a MiniMax API key looks like The key LeakWatch looks for starts with `sk-cp-`, followed by a very long run of letters, digits, dashes and underscores, well over a hundred characters: ```text sk-cp-…XXXX MiniMax subscription key (masked, over 100 characters after the prefix) ``` MiniMax has two kinds of keys, and it is worth knowing which one leaked. The **pay-as-you-go API key** is created under *Account*, *API Keys*. The **subscription key** is shown under *Billing*, *M Plan*, and is the one used for plan seats and purchased credits. MiniMax’s integration documentation shows the subscription key with the `sk-cp-` prefix. A pay-as-you-go key is shown with a different prefix, so it is not matched by this rule. Other providers’ keys also start with `sk-`; the dash-separated `cp` is what sets this one apart from the [OpenAI API key](/secrets/openai-api-key) and [Moonshot AI key](/secrets/moonshot-ai-api-key). ## How MiniMax API keys get leaked - **Coding-agent and editor configs.** The subscription key is the one people paste into coding agents and editor plugins. Their settings files, and MCP configuration, then land in a public dotfiles repository. - **Environment files.** `.env` files, Docker compose files and notebook configs copied into a repository, typically under a name like `MINIMAX_API_KEY`. - **Hardcoded in a script.** A quick client call with the key inline, committed as is. - **Browser code.** A key placed in front-end JavaScript so that a web page can call the API directly. MiniMax’s own guidance is to keep the key out of client-side code. - **Tutorials and shared notebooks.** A key pasted in a Colab notebook, a gist, an issue or a screenshot while asking for help. ## What to do in the first hour 1. **Work out which key it is.** A key starting with `sk-cp-` is a subscription key. Compare its last characters with what your account shows under *Billing*, *M Plan* and under *Account*, *API Keys*. 2. **Replace it.** For a pay-as-you-go key, create a new one under *Account*, *API Keys* and delete the old one from the same list. For a subscription key, check the *M Plan* page for an option to reset or regenerate it. I could not find a documented way to delete a subscription key, so if the page offers none, contact MiniMax support with the last characters of the key and ask for it to be invalidated. 3. **Deploy the new key** to every tool and application that used the old one, and confirm they still work. A coding tool that keeps working with the old key means the old key is still alive. 4. **Check usage.** Look at your usage and billing pages for the period since the exposure: requests you cannot explain, models you do not use, a plan allowance or credit balance that dropped faster than usual. 5. **Look at your plan.** If the key was a subscription key, check the seats and credits attached to the plan and compare them with what you expect. 6. **Look for other keys in the same place.** A configuration that held a MiniMax key often holds other providers’ keys. Rotate each of them at its own provider. 7. **Move the key out of the code.** Read it from an environment variable or a secret manager, keep it out of the browser, and remove the old value from the repository. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). Not sure what else leaked from the same repository? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at MiniMax MiniMax keys are managed from the account on the MiniMax platform: *Account*, *API Keys* for pay-as-you-go keys, and *Billing*, *M Plan* for the subscription key. Sign in with the account that owns the key. The platform’s documentation says MiniMax may disable a key that has leaked publicly, but it does not describe a manual delete step for every key type, so this guide does not claim one. Use the key list where it offers a delete or reset action, and support where it does not. Menu names change, so if the wording differs, look for the section where keys are created and listed. ## How LeakWatch detects it The rule is called MiniMax API Key. It matches the `sk-cp-` prefix followed by at least 100 characters, as a whole word, with the severity set to **high**. The prefix is sensitive to case and the generic OpenAI rule excludes it, so the key is not reported twice. **This type is checked live**: LeakWatch sends the smallest possible chat request, limited to a single output token, to see whether MiniMax still accepts the key. It reads none of your data. LeakWatch can check whether a detected key is still active with a read-only request to MiniMax. It never reads your data or spends your credits. ## FAQ My key does not start with sk-cp-. Is it still a leak? Yes. The rule only covers the subscription-key shape, so a pay-as-you-go key will not be flagged by it. Treat any MiniMax key in a public place as exposed and replace it. MiniMax may disable leaked keys. Do I still need to act? Yes. Automatic disabling is not something you can rely on, and it does not tell you what was used before it happened. Replace the key and check your usage. The key was only in a private repository. Should I still replace it? Yes, if the repository has collaborators, forks or CI logs, or if you are not sure who can read it. A new key costs you a few minutes. ## Related - [Moonshot AI (Kimi) API Key](/secrets/moonshot-ai-api-key) - [DeepSeek API Key](/secrets/deepseek-api-key) - [OpenRouter API Key](/secrets/openrouter-api-key) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with MiniMax. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)