Reissue the key in the dashboard: the old value stops working immediately and the new one is shown once. After that, update it everywhere it is configured and check whether anyone managed to use the leak.
The order of actions
- Reissue the key in the store keys section and save the new value at once — it will not be shown again.
- Update it in module settings, environment variables and any service that calls the API.
- Review operations since the leak: look for payments and refunds you did not initiate.
- Change passwords and enable two-factor authentication if dashboard access leaked too.
How to tell the key leaked
- The key showed up in a repository, a chat or a screenshot.
- Operations appeared that none of your services created.
- Notifications arrive at an address you never configured.
How to avoid a repeat
- Keep keys in environment variables, not in code or version-controlled configs.
- Give separate keys to separate services so revoking one does not stop everything.
- Reissue keys when an employee with access leaves.
How to store keys so this does not happen is covered separately.
