A Netlify access token authenticates calls to the Netlify API and the Netlify command line as the person who created it. With it, an attacker can list your sites, trigger and publish deploys, change build settings and read the environment variables attached to a site. The token reaches every team the user belongs to, so the damage depends on that user’s roles. Revoke it first, then check what changed.
Check your GitHub account for leaked secrets — free
- Provider
- Netlify
- Severity
- High
- Impact
- Cloud infrastructure access
- Checked live by LeakWatch
- No
What a Netlify access token looks like
A personal access token is a long string of lowercase letters, digits, dashes, underscores and sometimes = signs, between 40 and 46 characters, with no fixed prefix:
…XXXX Netlify access token (masked, 40 to 46 characters, no prefix)
Because nothing in the value says “Netlify”, the surrounding text does the work: a variable called NETLIFY_AUTH_TOKEN, a --auth flag to netlify-cli, or a request to api.netlify.com. Do not confuse it with the build hook URLs of a site, with a site ID (a UUID, not a secret) or with the API ID of an OAuth application.
How Netlify access tokens get leaked
- CI workflows.
NETLIFY_AUTH_TOKENwritten in plain text in a pipeline file instead of a secret. - Environment files. A
.envfile or a Docker compose file with the token committed alongside the site. - Deploy scripts. A shell script or
package.jsoncommand that callsnetlify deploy --auth …with the value inline. - Logs and screenshots. A verbose build log, a terminal capture or a support request that shows the token.
- Shared configuration. A
netlify.tomlor a dotfiles repository that carries the value across machines.
What to do in the first hour
- Find the token. In the Netlify dashboard, open your user settings, then the applications section where personal access tokens are listed. Match the token description and creation date against the leak.
- Create a new token with a descriptive name and keep it only in your CI secret store.
- Update your pipelines with the new value and run one deploy to confirm that it works.
- Revoke the exposed token from the same list. Requests made with a revoked token are rejected.
- Review recent activity. Open the deploy list of each site and look for deploys you did not start, rollbacks, or a different published version. Check forms, redirects, domains and team members for changes.
- Rotate site secrets. If the token could read a site’s environment variables, rotate each value that matters (database URLs, third-party keys, webhooks) at its own provider.
- Look for neighbours. The same file may hold other credentials. See I accidentally pushed an API key to GitHub.
Not sure what else leaked from the same repository? Run a free scan.
Revoke it at Netlify
Netlify lists personal access tokens in the applications section of your user settings, under a heading for personal access tokens. Sign in with the account that created the token, find the entry and revoke it. If the token was created by a colleague, only that colleague can revoke it from their own settings, so ask them, or ask a team owner to remove the member while you investigate. Netlify’s documentation covers the command line and API authentication. The interface can change, so if the labels differ, look for the section where tokens are created and listed.
How LeakWatch detects it
The rule is called Netlify Access Token. It is contextual: the word netlify has to appear shortly before an assignment sign (=, : or similar), followed by a value of 40 to 46 characters in the token alphabet. A token pasted without the word netlify close to it will be missed. The severity is high. This type is not checked live: LeakWatch does not test the value against Netlify, so a finding says a matching string was seen, not that the token is still valid. Look at your token list to see whether it is still there.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Can the token publish a different version of my site?
Yes, if the user behind it can deploy to that site. The token acts with the same rights as the user, so check the deploy history for versions you did not publish and restore the right one.
Do I need to rotate the environment variables of my sites?
If the user could read them, assume so. The token itself is replaced in minutes, but a database password copied from a site’s settings stays valid until you change it.
My token was in a private repository. Is it worth revoking?
Yes whenever you are not sure who can read the repository, its forks or its CI logs. Replacing a token costs little compared with an unexplained deploy.