Leaked Moonshot AI (Kimi) API Key: what to do in the first hour

• Hardcoded in a script. A quick OpenAI(api_key="sk-…", base_url="https://api.moonshot.ai/v1") call, because the Kimi API is compatible with the OpenAI client libraries, committed with the key inline.
• Environment files. .env files, Docker compose files and notebook configs copied into a repository.
• Coding agents and tool configs. Agent frameworks, editor plugins and MCP configuration files that store the key in plain text, then land in a public dotfiles repository.
• Browser code. A key placed in front-end JavaScript to call the API straight from a web page, where every visitor can read it.
• Tutorials and shared notebooks. A key pasted in a Colab notebook, a gist or a screenshot while demonstrating an integration.

1. Create a new key. Sign in to the Kimi API platform with the account that owns the key, open API Keys in the console and create a new one. Name it after where it will be used.
2. Deploy the new key to the application or secret store that used the old one, and check that the application still works.
3. Delete the exposed key. On the same API Keys page, delete the leaked one. Match it by its name or by the last characters shown in the list, not by guessing. Requests made with a deleted key are rejected.
4. Check usage and balance. Look at the balance and usage pages for the period since the exposure. Compare the balance with your last known level, and look for hours of volume you cannot explain. The platform is prepaid, so the balance is the ceiling of the damage; if you have auto top-up, switch it off until you have finished.
5. Check which platform it was on. If your team has both a global and a China account, search both consoles: a key you cannot find on one is probably on the other.
6. Look for other keys in the same place. A repository that held a Kimi key often holds other provider keys in the same .env or config file. Rotate each of them at its own provider.
7. Move the key out of the code. Read it from an environment variable or a secret manager, call the API from a backend rather than from the browser, and remove the old value from the repository. See I accidentally pushed an API key to GitHub.

Not sure what else leaked from the same repository? Run a free scan.

Moonshot AI keys are managed from the API Keys page of the Kimi API console, after you sign in with the account that created the key. The global console lives at platform.moonshot.ai (the Kimi documentation also uses platform.kimi.ai), and the China platform at platform.moonshot.cn. Find the exposed key in the list and delete it. If you cannot find it, you are probably signed in to the wrong account or the wrong platform, or it is not a Kimi key at all. Check the prefix and length above before searching further. The console can change over time, so if the wording differs from this guide, look for the section where keys are created and listed, and ask Moonshot support if no delete option is offered.

The rule is called Kimi API Key. It matches sk- followed by 48 to 52 letters and digits, and it leaves out the older OpenAI key shape that carries OpenAI’s own signature in the middle, so the same key is not reported twice under two providers. Because sk- plus about fifty characters is not unique to Moonshot, the severity is medium. This type is checked live: LeakWatch can check whether a detected key is still active with a read-only request that lists the available models, on the global endpoint and then the China one. It never sends a prompt, reads your data or spends your balance.