AI Provider Key Hygiene Kit: Find, Rotate and Cap API Keys

The AI Provider Key Hygiene Kit from WOWHOW helps a developer or a small team answer three questions fast when an API key may be out: where are our keys, how do we rotate them without breaking production, and how do we make the next leak cheap? It covers Anthropic, OpenAI, Google AI Studio and Gemini, Groq, OpenRouter, DeepSeek, xAI and Mistral, and the scanner also recognises Cohere, Hugging Face and AWS access key IDs.

Use it the day something goes wrong (a key in a public commit, a shared screenshot, or a hosted tool you stored keys in reports a breach) and before that day, so a leaked key hits a budget instead of an open bill. Everything is plain, readable and runs locally: Node 20+ scripts with no dependencies, Markdown runbooks, one GitHub Actions workflow and one Docker Compose file. Nothing calls a provider API and nothing is uploaded.

What You Get

• Key scanner (scan-keys.mjs): scans folders, every commit on every branch (git log -p, streamed), staged changes, and with opt-in flags your shell rc files, ~/.npmrc, VS Code and Cursor settings and ~/.config. It prints at most 8 characters of any key, plus a fingerprint so you can see where the same key appears. JSON output, exit code 1 on findings, placeholder filtering for documentation examples.
• 17 key rules, each with its source: shapes confirmed from the gitleaks default rules or the provider's own docs are marked verified; the rest are marked heuristic, with the reason, in a table in the README.
• Rotation runbook: for each of the eight providers, where to create a key, where to revoke it, where to see usage and cost, and whether a hard spend cap exists, checked against official documentation on 19 October 2026. Pages we could not confirm are marked as such.
• rotate-env.mjs: swaps a key in all your .env files, dry run by default, keeps quotes, comments and file permissions, never accepts the key as a command-line argument, and prints the gh secret set commands for GitHub.
• Containment proxy: a pinned LiteLLM and Postgres Compose setup so each app gets a virtual key with its own budget, model list and expiry, plus a smoke test that proves the budget limits on your machine with no provider key and no internet access.
• Checklists: the first 24 hours after an exposure (usage anomaly review, audit logs, revoke, notify) and a prevention list (pre-commit hook, CI job, per-key budgets, keeping keys out of hosted tools).
• Pre-commit hook and GitHub Actions workflow with read-only permissions, plus 94 automated tests and a VERIFY.md with the real output of every check.

How to Use

• Find: run the scanner with --history on each repository and with --home on your laptop. Every finding names the file and line, or the commit.
• Rotate: follow the runbook order for each key: create the new key, deploy it, verify it works, revoke the old one, then watch usage for 48 hours. Use rotate-env.mjs for the .env files and the printed gh commands for CI secrets.
• Contain: start the proxy, give each app its own virtual key with a monthly budget, and keep the raw provider keys in one place.
• Prevent: install the pre-commit hook, add the workflow as a required check, and set a spend cap at each provider.

Honest Limits

The scanner matches patterns; it cannot tell a live key from a revoked one, and it never asks the provider. Mistral and DeepSeek publish no key format, the Google docs we checked give none for the newer auth keys, and the Groq and OpenRouter lengths come from TruffleHog rather than the providers, so those rules are heuristic. History scanning sees the commits in your local clone, not forks, CI logs or chat attachments. Provider dashboards change; the runbook records the date it was checked. The proxy was tested end to end with LiteLLM's built-in mock model only: real provider calls were not tested, and budgets depend on LiteLLM knowing a model's price. Removing a key from git history does not un-leak it; rotation does.

Includes an MIT-style licence for use in your own projects, commercial ones included. This is an independent WOWHOW product, not affiliated with any of the providers named.

Related

If a hosted tool you used reports a breach, start with the step-by-step guide on rotating OpenAI and Anthropic keys after a console breach. For Claude Code budgets, see Claude Code Spend Guard; to price an agent run before you set a budget, use the free Agent Run Cost Simulator, or browse every WOWHOW kit.