Leaked Perplexity API Key: what to do in the first hour

• Hardcoded in a script. A quick search or chat call with the key inline, committed as it is.
• Environment files. .env files, Docker compose files and notebook configs copied into a repository.
• Agent and tool configs. Research agents, search plugins and MCP configuration files that store the key in plain text, then land in a public dotfiles repository.
• Browser code. A key placed in front-end JavaScript so that a web page can call the API directly, where every visitor can read it.
• Tutorials and shared notebooks. A key pasted in a Colab notebook, a gist, an issue or a screenshot.

1. Create a new key first. In the Perplexity API console, open the API Keys page of your project and generate a new key. Perplexity shows the full key once, so copy it straight into your secret store.
2. Deploy the new key to every application that used the old one, and check with a test request that it works.
3. Revoke the exposed key. Perplexity’s documentation says revocation is permanent: once a key is revoked it cannot be recovered. Do it in the console from the same API Keys page, or with a POST to the /revoke_auth_token endpoint, passing the key to revoke. Do this after step 2 so your application is not down in between, but do not leave it for later.
4. Check usage. Open your usage and billing pages for the period since the exposure. Look for requests you cannot explain, and for models or search features you do not use.
5. Check your credits and payment settings. Compare the credit balance with your last known level. If you have auto top-up or a card on file, set a low limit until you have finished reviewing.
6. Look for other keys in the same place. A repository that held a Perplexity key often holds other providers’ keys in the same file. Rotate each of them at its own provider.
7. Move the key out of the code. Read it from an environment variable or a secret manager, call the API from a backend rather than from the browser, and remove the old value from the repository. See I accidentally pushed an API key to GitHub.

Not sure what else leaked from the same repository? Run a free scan.

Perplexity keys are managed from the API console, under your project’s API Keys page, after you sign in with the account that created the key. Revoking a key there, or through the /revoke_auth_token endpoint described in Perplexity’s API key management guide, stops it from working. Because revocation cannot be undone, create and deploy the replacement first. If you cannot find the key, you are probably signed in to the wrong account or project, or it is not a Perplexity key. Console labels can change, so if the wording differs from this guide, look for the section where keys are created and listed.

The rule is called Perplexity API Key. It matches pplx- followed by exactly 48 letters and digits, followed by a quote, a space, a line end or a similar boundary, with the severity set to high. This type is not checked live: LeakWatch has no validator for it, so it can tell you that a key of the right shape is exposed, but not whether it still works. Assume it does until you have revoked it.