Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Pushed your API key to GitHub? Revoke it first, don't just delete it

Ship ItChecked against the official source

Source checked 9 Oct 2026 · Published 23 Oct 2026 · Last reviewed 23 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

Deleting the file in a new commit doesn't remove it from your Git history. GitHub's docs say that as a first step you need to revoke and/or rotate that secret. Once it's revoked or rotated, it can no longer be used for access, and that may be enough to solve your problem.

What to do

  1. Revoke the old key in the provider's dashboard.
  2. Create a new key and update your environment variables.
  3. Make sure .env is in your .gitignore.

Good to know

  • Rewriting the Git history may not be needed once the key is revoked, and it has side effects: GitHub warns it's unfortunately easy to re-push the sensitive data to the repository.

Source

Checked on 9 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.

Related