DarnlyAPI key leak checker: did I leak an API key?
Paste your site and we’ll check the JavaScript every visitor downloads for secret keys anyone can copy, like OpenAI, Stripe or a Supabase service_role key. Each key we find comes with three steps to fix it.
More free tools
How it works
- Paste the address of your live site.
- We read the page and up to 20 of its own JavaScript files, the same files every visitor’s browser downloads, and look for secret keys from OpenAI, Anthropic, Stripe, Supabase, AWS, GitHub, Google, Resend, SendGrid, Twilio, Firebase and more.
- For each key we find, you see what someone could do with it and three steps: rotate it, move the call to your server, and a prompt for your AI agent that does the move.
Questions
How can a key be leaked if my code is private?
Anything your site’s browser code uses ends up in the JavaScript files that every visitor downloads. Keys in variables that start with NEXT_PUBLIC_, VITE_ or PUBLIC_, or keys pasted straight into a component, are copied into those files when the site is built. Anyone can open them with View Source.
Do you see or keep my keys?
No key is ever sent back to your browser in full. You see only the type, the file it was in and a short preview like sk-ab…9f2, so you can tell which key it is. Results aren’t saved or cached, and nothing is logged.
I found a key. Is deleting it from my code enough?
No. Once a key has been on a public site, assume it has been copied. Rotate it first (make a new key and delete the old one in the provider’s dashboard), then move the code that uses it to your server so the new key never reaches the browser.
Which keys are fine to be public?
Stripe and Clerk keys that start with pk_, the Supabase anon or publishable key, and the Firebase web config are made to be in the browser. Supabase keys are only safe when Row Level Security is on. Google keys that start with AIza are often public too, but restrict them to your site so nobody can run up your bill.
What does “move the call to the server” mean?
Instead of your page calling OpenAI (or Stripe, or Resend) with the key, your page calls a small piece of code on your server, like an API route, an edge function or a serverless function. That code holds the key and makes the call. The “Copy prompt” button asks Claude Code, Cursor or Codex to do this for you.
Can it find every leaked key?
It checks the page you paste and the JavaScript it loads, which is where most leaks happen. It doesn’t log in, so code only loaded after sign-in isn’t checked, and it can’t see keys in your repository history. A clean result means none were found in the files listed, not that none exist.