A Plaid secret key authenticates your server to the Plaid API. With it, someone can call the endpoints that create and manage Link tokens, read account and transaction data for the bank connections your application has, and in some cases start new connections. Bank data is among the most sensitive data a financial application handles, so a leaked secret is a serious exposure. Rotate the secret first, then review what the API was used for.
Check your GitHub account for leaked secrets — free
- Provider
- Plaid
- Severity
- High
- Impact
- Payments and customer data
- Checked live by LeakWatch
- No
What a Plaid Secret Key looks like
A Plaid secret is a string of 30 lowercase letters or digits. Plaid issues a separate secret for each environment, such as sandbox, development and production, and each one is shown in the Dashboard. The rule does not look for a prefix. It relies on context: the word plaid appears on the same line as an assignment, followed by the 30-character value. In a file it usually looks like this:
PLAID_SECRET=…XXXX Plaid secret key (masked, 30 characters)
The variable name does not have to be exactly this. Any name containing plaid followed by an assignment operator is enough for the rule to fire. The client ID is a different value and is not what this rule looks for, so check the name of the match before you act on it.
How Plaid secret keys get leaked
- Server configuration. A
.envfile, a configuration file or a Docker setting that holds the secret, committed to the repository. - Sample and quickstart code. A Plaid quickstart project that was edited with a real secret and then published as a repository.
- Notebooks and scripts. A data analysis script or notebook that calls the API to pull transactions, with the secret typed into a cell.
- Pipeline variables. A CI step that writes the secret into a file or prints it in a log.
- Shared snippets. A secret pasted into a chat or support thread to debug a failing Link flow.
What to do in the first hour
- Rotate the secret. Sign in to the Plaid Dashboard and open the Keys section, which is where secrets are listed for each environment. Use the Rotate button for the affected secret. The new value is shown once, so copy it into your secret store at once. Only users with the Keys permission can rotate.
- Deploy the new secret to the services that use it. Run a test call in the same environment, such as a request that lists your items, to confirm the new value works.
- Delete the old secret. Plaid’s security documentation says the old secret stays active until you delete it with the Delete button. Delete it once the deployment is complete, so the exposure ends.
- Review API activity. Check the logs or activity your Plaid account shows for the period since the exposure. Look for calls from addresses you do not recognize, unexpected items created, and a rise in requests.
- Review connected items. List the items your application has, and check for connections you did not authorize. Remove any item you cannot account for.
- Revoke access tokens if needed. Access tokens for individual connections are separate credentials from the secret. If you suspect those were exposed too, Plaid provides an endpoint to invalidate them, and you should use it for each affected item.
- Clean the repository. Remove the value from the code, rewrite history if needed, and check for other secrets in the same files. See I accidentally pushed an API key to GitHub.
Not sure what else leaked? Run a free scan.
Revoke it at Plaid
Rotate and delete secrets from the Keys section of the Plaid Dashboard. Start at the API keys page, select the environment that holds the exposed secret, and rotate it. Then delete the old value from the same list. Keep in mind that secrets are per environment, so a leaked production secret does not affect sandbox, and the other way around. If the layout of the Dashboard has changed, look for the section that lists your client secrets.
How LeakWatch detects it
The rule is called Plaid Secret Key. It looks for the word plaid, case insensitive, followed by up to 20 characters of other text, then an assignment operator such as =, : or =>. It then reads exactly 30 lowercase letters or digits. A value of a different length, or one that is far from the word, is not reported. The severity is high, with the impact class payment data. This type is not checked live: LeakWatch does not send any request to Plaid with the secret it found.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Can someone read my customers' bank data with the secret?
A secret on its own cannot read data for every connection, since each connection has its own access token. But the secret is what lets someone create new connections and call endpoints that the access tokens depend on, so treat it as a serious exposure. Review the connected items and the API activity together.
Will rotating the secret break my application?
Only until you deploy the new value. Prepare the deployment first, then rotate, then delete the old secret once every service is updated. If you have reason to believe the secret is being used now, rotate at once and accept a short interruption.
Is the client ID also a secret?
The client ID is an identifier and is not what this rule matches. Still keep it in configuration rather than in public code, and rotate the secret, not the client ID, when the secret is exposed.