Skip to main content
A key that left its secret manager should be treated as compromised, even if nothing suspicious has happened yet. The steps take about a minute.

​
1. Revoke the key

Sign in at anythingmd.com, open Settings → API Keys and revoke the exposed key. Revocation takes effect immediately: after it, every call with that key is rejected with 401 on both the REST API and the MCP server. Revoking does not affect your other keys. If the key was embedded in a client config (Cursor, VS Code, Claude Code, Kilo), update that config to a new key from the environment variable ANYTHINGMD_API_KEY, not a literal. See the setup steps in MCP server.

​
2. Create a replacement

Create a new key in the same place. Choose the narrowest scopes the workload needs: documents:read for jobs that only fetch conversions and quotes, documents:write only where uploads, conversions or cancels happen.

​
3. Audit what the key did

Receipts do not expire and are queryable per job:
For a broader picture, check the credit balance on the Dashboard and the purchase history under Settings → Billing for a drop your own workload does not explain, and look at the job ids your own systems recorded around the exposure window. Job records themselves expire about 7 days after creation, so review promptly. If you find usage you did not make, contact support with the receipt ids.

​
4. Tell the workspace owner

If the key belonged to a teammate or a shared service, tell the workspace owner what was exposed, when it was revoked, and what the audit showed. Anything spent by the leaked key before revocation was charged to the workspace; failed and canceled jobs were not charged.

​
Avoiding the next one

  • Keep keys in environment variables or a secret manager; never in source, configs, notebooks, CI logs or chat transcripts.
  • Use per-service keys with minimal scopes so one leak does not expose everything.
  • Rotate keys on a schedule that matches your risk tolerance.