# Leaked Perplexity API Key? Revoke It and Check Usage > Perplexity API key (pplx-…) exposed on GitHub? Revoke it, create a new one, check usage and clean up. Step-by-step guide. Source: https://leakwatch.net/secrets/perplexity-api-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Perplexity API Key AI · Secret guide # Leaked Perplexity API Key: what to do in the first hour High severityDetected onlyLast verified October 19, 2026 · 5 min read A Perplexity API key lets whoever holds it call Perplexity’s Sonar models and search API as your account, with the usage billed to you. It does not open your Perplexity chat history and it does not reach your servers. The risk is spending: someone else’s requests, paid by your credits or card. The key carries no user identity and no second factor, so there is nothing to stop a stranger who finds it. Replace it, revoke the old one, then look at how much it was used. [Check your GitHub account for leaked secrets — free](/) Provider Perplexity Severity High Impact SaaS account access and billing Checked live by LeakWatch No ## What a Perplexity API key looks like A Perplexity key starts with `pplx-`, followed by 48 letters and digits: ```text pplx-…XXXX Perplexity API key (masked, 48 characters after the prefix) ``` The prefix is specific to Perplexity, which makes this one easy to recognise and to search for. Your own copy sits in a variable such as `PERPLEXITY_API_KEY` or `PPLX_API_KEY`, next to a call to `api.perplexity.ai`. Perplexity’s API is compatible with OpenAI-style client libraries, so a leaked key often appears in code that looks like an OpenAI call with a different base URL. Do not confuse it with the Perplexity web app login: the key and your account password are separate things. ## How Perplexity API keys get leaked - **Hardcoded in a script.** A quick search or chat call with the key inline, committed as it is. - **Environment files.** `.env` files, Docker compose files and notebook configs copied into a repository. - **Agent and tool configs.** Research agents, search plugins and MCP configuration files that store the key in plain text, then land in a public dotfiles repository. - **Browser code.** A key placed in front-end JavaScript so that a web page can call the API directly, where every visitor can read it. - **Tutorials and shared notebooks.** A key pasted in a Colab notebook, a gist, an issue or a screenshot. ## What to do in the first hour 1. **Create a new key first.** In the Perplexity API console, open the *API Keys* page of your project and generate a new key. Perplexity shows the full key once, so copy it straight into your secret store. 2. **Deploy the new key** to every application that used the old one, and check with a test request that it works. 3. **Revoke the exposed key.** Perplexity’s documentation says revocation is permanent: once a key is revoked it cannot be recovered. Do it in the console from the same *API Keys* page, or with a `POST` to the `/revoke_auth_token` endpoint, passing the key to revoke. Do this after step 2 so your application is not down in between, but do not leave it for later. 4. **Check usage.** Open your usage and billing pages for the period since the exposure. Look for requests you cannot explain, and for models or search features you do not use. 5. **Check your credits and payment settings.** Compare the credit balance with your last known level. If you have auto top-up or a card on file, set a low limit until you have finished reviewing. 6. **Look for other keys in the same place.** A repository that held a Perplexity key often holds other providers’ keys in the same file. Rotate each of them at its own provider. 7. **Move the key out of the code.** Read it from an environment variable or a secret manager, call the API from a backend rather than from the browser, and remove the old value from the repository. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github). Not sure what else leaked from the same repository? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Perplexity Perplexity keys are managed from the API console, under your project’s *API Keys* page, after you sign in with the account that created the key. Revoking a key there, or through the `/revoke_auth_token` endpoint described in Perplexity’s [API key management guide](https://docs.perplexity.ai/docs/admin/api-key-management), stops it from working. Because revocation cannot be undone, create and deploy the replacement first. If you cannot find the key, you are probably signed in to the wrong account or project, or it is not a Perplexity key. Console labels can change, so if the wording differs from this guide, look for the section where keys are created and listed. ## How LeakWatch detects it The rule is called Perplexity API Key. It matches `pplx-` followed by exactly 48 letters and digits, followed by a quote, a space, a line end or a similar boundary, with the severity set to **high**. **This type is not checked live**: LeakWatch has no validator for it, so it can tell you that a key of the right shape is exposed, but not whether it still works. Assume it does until you have revoked it. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Can someone read my Perplexity searches with this key? No. The API key makes requests as your API account. It does not open the history of the web app. What it exposes is your credits and the ability to run requests as you. I revoked the key. Can I get it back if I made a mistake? No, revocation is permanent. That is why the order matters: create the new key, deploy it, then revoke the old one. The key was only in a private repository. Should I still replace it? Yes, if the repository has collaborators, forks or CI logs, or if you are not sure who can read it. Replacing a key is cheap, and a key you doubt is worth less than a new one. ## Related - [OpenAI API key](/secrets/openai-api-key) - [Anthropic (Claude) API Key](/secrets/anthropic-api-key) - [Groq API Key](/secrets/groq-api-key) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Perplexity. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)