[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"questions:item:en:what-if-the-secret-key-leaks":3},{"id":4,"title":5,"answer":6,"body":7,"category":80,"description":81,"extension":82,"meta":83,"modifiedAt":84,"navigation":85,"pairId":86,"path":87,"publishedAt":88,"question":89,"relatedPath":90,"seo":91,"seoTitle":92,"sitemap":93,"slug":94,"stem":95,"translationSlug":96,"__hash__":97},"questions_en\u002Fen\u002Fquestions\u002Fwhat-if-the-secret-key-leaks.md","What If The Secret Key Leaks","Reissue the key in the dashboard: the old value stops working immediately and the new one is shown once. After that, update it everywhere it is configured and check whether anyone managed to use the leak.",{"type":8,"value":9,"toc":73},"minimark",[10,13,18,34,38,49,53,64],[11,12,6],"p",{},[14,15,17],"h2",{"id":16},"the-order-of-actions","The order of actions",[19,20,21,25,28,31],"ul",{},[22,23,24],"li",{},"Reissue the key in the store keys section and save the new value at once — it will not be shown again.",[22,26,27],{},"Update it in module settings, environment variables and any service that calls the API.",[22,29,30],{},"Review operations since the leak: look for payments and refunds you did not initiate.",[22,32,33],{},"Change passwords and enable two-factor authentication if dashboard access leaked too.",[14,35,37],{"id":36},"how-to-tell-the-key-leaked","How to tell the key leaked",[19,39,40,43,46],{},[22,41,42],{},"The key showed up in a repository, a chat or a screenshot.",[22,44,45],{},"Operations appeared that none of your services created.",[22,47,48],{},"Notifications arrive at an address you never configured.",[14,50,52],{"id":51},"how-to-avoid-a-repeat","How to avoid a repeat",[19,54,55,58,61],{},[22,56,57],{},"Keep keys in environment variables, not in code or version-controlled configs.",[22,59,60],{},"Give separate keys to separate services so revoking one does not stop everything.",[22,62,63],{},"Reissue keys when an employee with access leaves.",[11,65,66,67,72],{},"How to store keys so this does not happen is covered ",[68,69,71],"a",{"href":70},"\u002Fen\u002Fquestions\u002Fhow-to-store-api-keys","separately",".",{"title":74,"searchDepth":75,"depth":75,"links":76},"",2,[77,78,79],{"id":16,"depth":75,"text":17},{"id":36,"depth":75,"text":37},{"id":51,"depth":75,"text":52},"security","The key is reissued in the dashboard and the old one stops working at once. The order of actions and how to tell the key leaked at all.","md",{},null,true,"question-40","\u002Fen\u002Fquestions\u002Fwhat-if-the-secret-key-leaks","2026-08-17","What to do if the secret key ends up in the wrong hands?","\u002Fen\u002Fpayment-api",{"description":81},"The secret key leaked: what a merchant should do",{"loc":87},"what-if-the-secret-key-leaks","en\u002Fquestions\u002Fwhat-if-the-secret-key-leaks","chto-delat-esli-utek-sekretnyy-klyuch","yyKwnVCuuF-Ie0sWARmhx-6P865pXEVJ7VS_ZP_3Zo0"]