# Leaked Paystack Secret Key? Regenerate It Now > Paystack secret key exposed on GitHub? Regenerate it, review transactions, transfers and webhooks, and limit future exposure. Step-by-step guide. Source: https://leakwatch.net/secrets/paystack-secret-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Paystack Secret Key Payments · Secret guide # Leaked Paystack Secret Key: what to do in the first hour Critical severityDetected onlyLast verified October 19, 2026 · 4 min read A live Paystack secret key lets whoever holds it call the Paystack API as your business: reading transactions and customer details, creating charges and payment links, refunding payments and, depending on your account settings, initiating transfers to bank accounts. That makes it one of the most damaging keys to leak, and the fix is quick. Regenerate the key first, then read what happened on the account. [Check your GitHub account for leaked secrets — free](/) Provider Paystack Severity Critical Impact Payments and customer data Checked live by LeakWatch No ## What a Paystack secret key looks like A Paystack secret key starts with `sk_`, then a mode word, then a second underscore and 40 letters and digits: ```text sk_live_…XXXX secret key, live mode → real money. Treat a leak as an incident. sk_test_…XXXX secret key, test mode → no real money, but still replace it. pk_live_…XXXX public key → meant to be embedded in client code. ``` The public key (`pk_`) is designed to appear in a web page or app and is not a leak by itself. The secret key must stay on your server. The look of the secret key is close to a Stripe one, since both begin `sk_live_` or `sk_test_`, but Stripe bodies differ in length, and the pattern described below requires exactly 40 characters after the mode word. The variable name is usually `PAYSTACK_SECRET_KEY`, and a call to `api.paystack.co` is a good hint. ## How Paystack secret keys get leaked - **Hardcoded in server code** during integration and never moved to an environment variable. - **The wrong key in the front end.** The secret key was used where the public one belongs, so it shipped inside a JavaScript bundle or a mobile app. - **Checkout plugins.** A store plugin or theme configuration that holds both keys, exported or committed with the site. - **Webhook and cron scripts** run on a server and committed along with their configuration. - **Documentation and support.** A curl example with `Authorization: Bearer sk_live_…` in a README, a Postman collection, a ticket or a screenshot. ## What to do in the first hour 1. **Open the API keys page** of the Paystack Dashboard (see the link below), under the settings area for API keys and webhooks. Test and live keys are shown separately, so make sure you are on the right mode. 2. **Regenerate the exposed key.** Generating a new secret key replaces the old one. Because the key is compromised, make sure the old value stops working at once rather than after any grace period the dashboard may offer. 3. **Deploy the new key** to your servers, and check that a test payment goes through. Store it in an environment variable or secret manager. 4. **Review transactions.** Look at the transaction list for the period since the exposure: payments, refunds and charges you do not recognize. 5. **Review transfers and recipients.** Check transfer recipients and any payouts. A newly added recipient followed by a transfer is the pattern to look for. If transfers need an approval step or a PIN, confirm that this is enabled. 6. **Review webhooks and settings.** Make sure the webhook and callback URLs are yours, and that no settings or team members changed. Check the list of dashboard users. 7. **Assess customer data.** If the logs suggest customers’ details were read, you may have notification duties. Talk to Paystack support and a qualified adviser. Then clean the repository; see [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). Not sure what else leaked from the same repository? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Paystack Paystack secret keys are managed from the API keys and webhooks page of your Paystack Dashboard, after you sign in as an owner or an administrator. Regenerate the exposed key so that the old value is retired. Paystack’s developer documentation describes the key types and how to keep them safe. A person has not confirmed the exact menu wording for this guide, and dashboards change, so if what you see differs from this description, look for the page where keys and webhook URLs are listed, and check Paystack’s documentation. ## How LeakWatch detects it The rule is called Paystack Secret Key. It recognizes `sk_` followed by a word of lowercase letters (such as `live` or `test`), an underscore and exactly 40 letters and digits, with word boundaries on both sides. It does not need a variable name next to the value. Public keys (`pk_`), and strings with a different length, are not reported. The severity is **critical**, because the key can move money and read customer data. This type is not checked live: LeakWatch does not send any request to Paystack with the key it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Is a leaked pk\_live\_ public key dangerous? Not on its own. Public keys are meant to be embedded in client code. What matters is that the secret key did not leak next to it. My leaked key was a test key. Do I still need to act? The urgency is lower, because test mode cannot touch real money. Regenerate it anyway: it exposes your test data and setup, and it suggests the same habit may have leaked a live key. How can I tell whether someone used the key? Review transactions, refunds, transfers and webhook settings for activity you did not cause, and contact Paystack support right away if you find some. ## Related - [Stripe secret key](/secrets/stripe-secret-key) - [Razorpay API Key](/secrets/razorpay-key) - [Shopify Access Token](/secrets/shopify-access-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Paystack. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)