Leaked NVIDIA API Key: what to do in the first hour

• Environment files committed by accident. An .env file with a variable such as NVIDIA_API_KEY that was never added to .gitignore.
• Notebooks and examples. A key pasted into a notebook cell to test a model, then published with its output or shared in a repository.
• Sample code from tutorials. A quick-start script that someone edited with a real key and then committed.
• Front-end code. A demo page that calls the API directly from the browser, which ships the key to every visitor. Calls should go through your own backend.
• CI and container configuration. A key written into a pipeline definition, a Docker image or a compose file, where it is visible to anyone who can read the repository or pull the image.

1. Create a replacement key first. Sign in to the NVIDIA account that owns the leaked key and open the API keys page from the account menu. Create a new key, and give it a name that says where it will be used, so that you can tell the keys apart later.
2. Deploy the new key to your secret manager or environment, then confirm that the application still works. Keep one key per application so that the next rotation affects less.
3. Disable the exposed key. Use the revocation steps below. Calls with the old value must fail once it is gone, so check that nothing else still depends on it.
4. Check usage. Look at the usage and billing views for the account for the period since the exposure. Look for spikes, for models your application never calls, and for traffic at unusual times. Usage figures can lag, so check again a few hours later.
5. Review the account. Check which other people have access to the account and to its projects, and remove anyone you do not recognize. Confirm where billing alerts are sent.
6. Clean the repository. Remove the value from the files and rewrite history if you want to. See I accidentally pushed an API key to GitHub, and deep scan your whole git history if the value may sit in an older branch.

Not sure what else leaked? Run a free scan.

Create and manage your API keys on the API keys page of your NVIDIA account, which you can reach from the account menu on the API catalog site. Find the key that matches the leaked value and remove it. The NVIDIA documentation we checked describes creating keys on that page but does not describe the steps for deleting one, so confirm that the option exists in your account before you rely on it. If you cannot find a way to disable the old key, contact NVIDIA support and tell them which key is exposed. If the leaked value was an NGC personal key rather than a key with the nvapi- prefix, manage it in NGC instead, where deleting a key takes effect immediately.

The rule is called NVIDIA API Key. It looks for the literal nvapi- prefix at a word boundary, followed by exactly 64 letters and digits, and the match must end at a word boundary too. Because the length is fixed and the prefix is distinctive, the rule does not need a nearby word to fire, and the keyword nvapi- narrows the search. The severity is high. This type is not checked live: LeakWatch does not send any request to NVIDIA with the value it found, so a finding does not tell you whether the key still works.