FREE CHECKLIST

Rotate your AI provider keys, one provider at a time.

If a coding agent or a tool you use ever stored your provider keys, a tidy rotation takes about 20 minutes. This page walks you through it for OpenAI, Anthropic and Google. Tick boxes save in your own browser only. Nothing is sent anywhere.

Why this exists. OpenCode said that third party provider keys saved in an OpenCode Console workspace may have been exposed after unauthorized access to a legacy system, and emailed affected users. It has not said any key was copied or used. It also said the OpenCode CLI and desktop app are not part of it. Sources: The Hacker News, StepSecurity. The incident was still being reported when we wrote this, and the two sources give different dates for the email. We make no claim that your keys were taken. Rotation is cheap, so do it if you ever pasted a key into a hosted tool.

1. Pick your provider

2. Where keys hide on your machine

A new key does not help if the old one still sits in a file. Check each place, then run the same checks for every tool you use.

Tool credential files. OpenCode stores provider credentials in ~/.local/share/opencode/auth.json (docs). Codex can store an OPENAI_API_KEY in $CODEX_HOME/auth.json (source).
Project files. .env, .env.local, docker compose files, CI settings, notebooks.
Shell history and profile. ~/.zshrc, ~/.bashrc, ~/.zsh_history. A key you exported once may still be in history.
Hosted tools. Any web console, workspace or team tool where you pasted a provider key.
Old repos and backups. Search git history, not only the current files.

Free one line check. This prints only the names of files that contain key shaped text. It never prints the keys. Change ~/code to your projects folder. It is pattern matching, so it can miss keys and flag non keys.

grep -rIlE 'sk-(ant-|proj-|svcacct-)?[A-Za-z0-9_-]{20,}|AIza[0-9A-Za-z_-]{35}' ~/.local/share/opencode ~/.codex ~/.claude ~/.config ~/code 2>/dev/null

The paid kit includes a small read only script that finds these and prints masked previews, never full keys.

3. Spend alerts

Set a cap so a leaked key cannot run up a large bill while you sleep. Each provider names these differently:

OpenAI: spend limits guide
Anthropic: rate and spend limits. Use workspaces to keep one key per project.
Google: see the API key page for restricting and replacing keys.

4. Want it done for a small team?

What is at stake. A leaked provider key can be used to run up usage on your account until it is deleted or capped, and provider spend limits exist to bound that (see the OpenAI and Anthropic guides). The kit is built so one person can rotate and cap a small team in about 30 minutes. We do not claim any key of yours was taken.

Pro, $249 one time

Key rotation kit Pro

Everything in Team
Audit workbook (.xlsx) with formulas: key plan with next due dates and overdue flags, rotation log, usage audit, where keys hide per machine, summary counts
One free update

Get Pro, $249

Team, $99 one time

Key rotation kit Team

Everything in Starter
Usage log audit worksheet
30 minute rotation runbook
Incident note template
One free update

Get Team, $99

Starter, $29 one time

Key rotation kit Starter

Per tool key plan template
Spend cap worksheet with the steps for each provider
keyfind.py, a read only local script that lists files with key like strings, masked

Get Starter, $29

Team and Pro include one free update: if the source changes materially, we revise your kit page once, at the same link, at no cost. Templates and checklists only, no outcome guarantee.

Get the next guide

We plan to add guides for more providers. Leave your email and we will send one email when they are ready. No other mail, no sharing your address. Unsubscribe any time with the link, or at /unsubscribe, or reply STOP to fuseini.metadata@gmail.com.

Privacy: we store your email address and the time you signed up, nothing else, to send that one email. It is kept on Cloudflare. We do not sell or share it.