# Leaked NVIDIA API Key? Revoke It and Check Usage > NVIDIA API key exposed on GitHub? Create a replacement, remove the leaked one, check your usage and keep the new key out of code. Step-by-step guide. Source: https://leakwatch.net/secrets/nvidia-api-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. NVIDIA API Key AI · Secret guide # Leaked NVIDIA API Key: what to do in the first hour High severityDetected onlyLast verified October 23, 2026 · 5 min read An NVIDIA API key lets whoever holds it call the hosted models that NVIDIA offers through its API catalog, and every request is charged to the account that issued the key. The key is the whole credential: there is no second factor and no per-user sign-in behind it. Replace the key first, then look at how it was used, because a stolen key can run up usage on your account without anyone noticing for a while. [Check your GitHub account for leaked secrets — free](/) Provider NVIDIA Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What an NVIDIA API Key looks like Keys in this format start with the literal prefix `nvapi-`, followed by exactly 64 letters and digits: ```text nvapi-…XXXX NVIDIA API key (masked) ``` The prefix is specific enough that a hit is rarely a false alarm, but the value on its own does not say which account it belongs to. Other NVIDIA credentials, such as the personal keys used for NGC container registry access, may use a different format. If a leaked file contains one of those too, check it separately. ## How NVIDIA API Keys get leaked - **Environment files committed by accident.** An `.env` file with a variable such as `NVIDIA_API_KEY` that was never added to `.gitignore`. - **Notebooks and examples.** A key pasted into a notebook cell to test a model, then published with its output or shared in a repository. - **Sample code from tutorials.** A quick-start script that someone edited with a real key and then committed. - **Front-end code.** A demo page that calls the API directly from the browser, which ships the key to every visitor. Calls should go through your own backend. - **CI and container configuration.** A key written into a pipeline definition, a Docker image or a compose file, where it is visible to anyone who can read the repository or pull the image. ## What to do in the first hour 1. **Create a replacement key first.** Sign in to the NVIDIA account that owns the leaked key and open the API keys page from the account menu. Create a new key, and give it a name that says where it will be used, so that you can tell the keys apart later. 2. **Deploy the new key** to your secret manager or environment, then confirm that the application still works. Keep one key per application so that the next rotation affects less. 3. **Disable the exposed key.** Use the revocation steps below. Calls with the old value must fail once it is gone, so check that nothing else still depends on it. 4. **Check usage.** Look at the usage and billing views for the account for the period since the exposure. Look for spikes, for models your application never calls, and for traffic at unusual times. Usage figures can lag, so check again a few hours later. 5. **Review the account.** Check which other people have access to the account and to its projects, and remove anyone you do not recognize. Confirm where billing alerts are sent. 6. **Clean the repository.** Remove the value from the files and rewrite history if you want to. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github), and [deep scan your whole git history](/blog/deep-scan-your-whole-git-history) if the value may sit in an older branch. Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at NVIDIA Create and manage your API keys on the API keys page of your NVIDIA account, which you can reach from the account menu on the API catalog site. Find the key that matches the leaked value and remove it. The NVIDIA documentation we checked describes creating keys on that page but does not describe the steps for deleting one, so confirm that the option exists in your account before you rely on it. If you cannot find a way to disable the old key, contact NVIDIA support and tell them which key is exposed. If the leaked value was an NGC personal key rather than a key with the `nvapi-` prefix, manage it in NGC instead, where deleting a key takes effect immediately. ## How LeakWatch detects it The rule is called NVIDIA API Key. It looks for the literal `nvapi-` prefix at a word boundary, followed by exactly 64 letters and digits, and the match must end at a word boundary too. Because the length is fixed and the prefix is distinctive, the rule does not need a nearby word to fire, and the keyword `nvapi-` narrows the search. The severity is **high**. This type is not checked live: LeakWatch does not send any request to NVIDIA with the value it found, so a finding does not tell you whether the key still works. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone read my data through this key? The key authenticates calls to the models. It does not give access to your application’s data. What an attacker can do is send requests as your account, which means they can use your quota and bill your account, and they can see any output returned to them. Check the usage figures for unexpected activity. I only saw the key for a few minutes. Do I still need to replace it? Yes. Automated scanners watch public repositories continuously, so a few minutes is enough. Replacing the key takes a few minutes too, and it is far cheaper than an unexpected bill. Why is there no live check for this type? LeakWatch checks live only for types where a read-only request can confirm a key is active without spending credits or touching your data. For this rule, that check has not been set up, so the finding is based on the format alone. Treat it as active until you have replaced the key. ## Related - [Hugging Face Access Token](/secrets/huggingface-access-token) - [Replicate API Token](/secrets/replicate-api-token) - [Groq API Key](/secrets/groq-api-key) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with NVIDIA. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)