OpenAI keys are among the most aggressively harvested credentials on Replit, because a working key can be resold or used to generate content at your expense. Attackers often run up hundreds or thousands of dollars before you notice. If your key was in a public Repl or inline in code, revoke it right now.
Why it's a problem
A leaked OpenAI key is money. Bots scan public Repls specifically for these, and once found the key is used immediately to make paid API calls until it is revoked. There is no data breach needed; the bill itself is the damage, and it can be large.
How to fix it, in order
- 1Revoke the key at OpenAI immediately. Delete the exposed key in the OpenAI dashboard and create a new one. This stops the billing damage.
- 2Check your OpenAI usage and billing. Look for a spike in calls or spend you did not make, and set a usage limit while you are there.
- 3Move the key into Replit Secrets. Store it in the Secrets pane, not in code or a committed .env, so forks and viewers cannot read it.
- 4Call the API server-side. Make the OpenAI request from server code so the key is never in client JavaScript.
Why Replit does this
The Replit Agent often generates client-side JavaScript that calls the OpenAI API directly with the key inline, exposing it in the browser. Even when meant to be server-side, the fastest working version can embed the value where it ships publicly.
Stop it happening again
Keep the OpenAI key in Replit Secrets and call the API only from the server. Set a spending limit in the OpenAI dashboard as a safety net. Scan the Repl for any inline key before making it public.
The quick fix
- Revoke the key at OpenAI now; leaked keys are used within minutes.
- Check OpenAI usage and set a spending limit.
- Move the key into the Replit Secrets pane.
- Call the OpenAI API server-side, never from the browser.
Common questions
How fast do attackers find leaked OpenAI keys on Replit?
Bots scan public Repls continuously. An exposed key can be harvested and used within minutes of being pushed or shared. Revoke it at OpenAI before doing anything else.
How do I set a spending limit on my OpenAI account?
In the OpenAI dashboard, go to Settings then Billing and set a monthly usage limit. This caps the damage if a key is exploited before you notice the activity.
After I move the key to Replit Secrets, how does my code access it?
The same way as any environment variable: process.env.OPENAI_API_KEY in Node.js or os.environ.get('OPENAI_API_KEY') in Python. Replit injects Secrets as environment variables at runtime.