If a key leaks

“Leaked” means a key ended up somewhere it shouldn’t have — posted in a public place, left in code that got shared publicly, or held by a developer or agency you no longer work with. Treat any of these as a leak, even if you’re not sure anyone used it.

What to do

1. Open API Keys & Widget in your dashboard.
2. Find the leaked key in the list and revoke it.
3. Issue a replacement key (see Getting your API keys) and update it wherever the old one was used — your website’s server settings, your developer’s config — before telling anyone the old key is gone.

No waiting period

The old key stops working immediately — the very next request made with it is refused, not the next hour or the next day.

Only an account admin can revoke or issue keys. If you don’t have admin access, tell whoever does, right away — don’t wait to confirm whether the leaked key was actually misused.

Practical habits that make this easier

• Give each website or integration its own key, rather than reusing one key everywhere. If one leaks, you revoke only that one key — everything else using a different key keeps working.
• Use test keys while building, and only issue live keys when you’re ready to go live. A leaked test key can’t touch real bookings or real money.

Caution

Never send a secret key over chat, email, or a support ticket — not even to us. The safe-to-share prefix printed on a key (for example pk_live_ followed by a few characters) is enough to identify it if you do need to ask us for help.

If you need help

If you’re not sure whether a key leaked, or you don’t have admin access to revoke it yourself, tell your usual contact with us. We can look up and revoke a key on your behalf, but doing it yourself in the dashboard is faster — the moment you click revoke, the old key is off.

Next steps

• Getting your API keys — issuing the replacement.
• Secret keys vs. publishable keys — a refresher on which kind goes where.