A Replicate API token lets whoever holds it run models on Replicate and have the compute billed to your account. Replicate charges for the time models run, so a stolen token can turn into a real bill quickly, especially if someone starts large image or video models in a loop. The token can also be used to read what your account has run and to manage your own models and deployments. It does not reach your servers. Delete the token first, then look at what was run.
Check your GitHub account for leaked secrets — free
- Provider
- Replicate
- Severity
- High
- Impact
- SaaS account access and billing
- Checked live by LeakWatch
- No
What a Replicate API token looks like
Replicate tokens start with r8_, followed by 37 letters, digits, hyphens or underscores, which makes 40 characters in total:
r8_…XXXX Replicate API token (masked, 40 characters)
The prefix is a reliable marker: few other credentials begin with r8_, so a match is usually a real token. The variable that normally holds it is REPLICATE_API_TOKEN, which the official client libraries read automatically. That convenience is part of the problem, because a token exported in a shell profile or a container image is picked up silently by every script that runs next to it.
How Replicate API tokens get leaked
- Committed environment files.
REPLICATE_API_TOKENin a.envfile or a Docker compose file that ends up in the repository. - Demo apps and model wrappers. A small web app that calls Replicate from the browser, so the token ships to every visitor, or a Space and notebook that prints its environment.
- Container images. A token baked into an image with
ENVor copied with the build context, then pushed to a public registry. - Shell history and CI logs. A token pasted into a command, printed by a debug option, or left in a build log that is public.
- Shared snippets. A curl command with an
Authorizationheader pasted into an issue, a forum post or a screenshot.
What to do in the first hour
- Open the API tokens page of your Replicate account (see the link below). The list shows the name of each token and when it was created, which helps you pick the exposed one.
- Create a new token with a name that says which service uses it, so you can revoke it independently next time.
- Deploy the new token to the application or secret store, then run a cheap prediction to confirm it works.
- Delete the exposed token from the same list. Requests made with a deleted token should be rejected.
- Check what was run. Look at your recent predictions and at the billing and usage views for the period since the exposure. Red flags are expensive models you never call, a burst of predictions overnight, or models and deployments you did not create.
- Check your own models and deployments. Anyone with the token can manage resources that belong to your account. Look for new deployments, changed versions or models you do not recognize, and remove them.
- Set a spending limit if your account offers one, and move the token into a secret manager. For the full order of operations, read I accidentally pushed an API key to GitHub.
Not sure what else sat in the same file? Run a free scan.
Revoke it at Replicate
Replicate tokens are managed from the API tokens page of your Replicate account, after you sign in with the account that owns them. Find the exposed token and delete it. If it is not in the list, check whether the token belongs to a different account or organization than the one you are signed in to. A person has not confirmed the exact wording of this page for this guide, and the interface can change, so if what you see differs, look for the section where tokens are created and listed, and check Replicate’s documentation.
How LeakWatch detects it
The rule is called Replicate API Token. It recognizes the r8_ prefix followed by 37 letters, digits, hyphens or underscores, with word boundaries on each side. It does not need a variable name next to the value, because the prefix is distinctive enough. The severity is high, since the token spends money on a third-party service. This type is not checked live: LeakWatch does not send any request to Replicate with the token it found.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
How fast can a stolen Replicate token cost me money?
As fast as someone can start predictions: the compute is billed per second of model run time. That is why deleting the token comes before reading logs. Check your billing view afterwards and contact Replicate support if you see charges you did not cause.
Is a token in a private repository still a problem?
It is a smaller risk, not zero: every collaborator, fork and CI log can read it. Treat it as exposed if the repository was ever public or is shared with people who should not have it.
Will deleting the token break my running apps?
Anything that used it will fail until you deploy the new one. That is why the order is create, deploy, then delete, unless the token is clearly being abused, in which case delete it immediately and accept the interruption.