• SECURE
  • AUDIT
  • RECOVERY
  • HUMAN

How to revoke leaked API keys with your AI

Connect Unkey to your AI client to turn a security breach into a quick cleanup task. Once connected, your agent handles the heavy lifting of finding and disabling keys.

Ask AI about this page

Short answer

How can I revoke leaked API keys using my AI?

Tell your AI to find your Unkey keys and revoke the ones that look suspicious or were leaked. It will pull your current key list and then disable the specific ones you point out. You'll get a clean environment without manual dashboard hunting.

The outcomes of a cleanup

What you get after the cleanup

What happens after you give your AI the command.

SECURE

Compromised keys killed

The AI uses the revocation tool to instantly disable any key you identify as leaked. This stops unauthorized traffic immediately.

AUDIT

Full key inventory

Your agent pulls a complete list of every active key in your Unkey account. You'll see exactly what's running before you make changes.

RECOVERY

Infrastructure stabilized

Once the bad keys are gone, your API usage returns to normal. You'll have a clear view of your remaining valid credentials.

HUMAN

Manual verification needed

You decide which keys are actually dangerous. The AI won't guess and delete keys without your explicit confirmation.

The workflow

What your AI does when a leak is detected.

The AI moves from discovery to enforcement in seconds.

  1. Scan for keys

    The agent pulls your entire Unkey key inventory to see what is currently active.

    list_api_keys

  2. Identify leaks

    You tell the AI which specific key IDs or names look compromised based on your logs.

    list_api_keys

  3. Kill the key

    The AI sends a command to Unkey to immediately invalidate the compromised credential.

    revoke_api_key

  4. Confirm status

    The agent checks the updated list to ensure the revoked key is no longer active.

    list_api_keys

Try it

Copy these to start.

Use these prompts to trigger the cleanup process.

Starting points

These are basic commands. You can swap out the specific key names or IDs to match your actual Unkey setup.

Unkey Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_yjns51tu1Zuz7DUjeNeGeF2BKD96k4G9BaUoTlA0/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Unkey capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "unkey-api-management-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_yjns51tu1Zuz7DUjeNeGeF2BKD96k4G9BaUoTlA0/mcp"
    }
  }
}
Copy into chat04

  • List all my Unkey API keys so I can check them.

  • I think my 'production-web-app' key was leaked. Can you find it and revoke it?

  • Show me all active keys and tell me which ones belong to the 'test-user' account.

  • Revoke the API key with ID 'key_12345' immediately.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Unkey API Management once, then ask.

Just link your Unkey account once. Your credentials stay encrypted and secure, and you can immediately start managing keys through your favorite AI client.

Connect Unkey API Management to your AI

FAQ

How the cleanup behaves

  • 01

    Can the AI delete my entire Unkey account?

    No. The AI only has tools to list and revoke specific keys.

  • 02

    Will the AI revoke keys without asking me first?

    No. The AI performs the revocation only when you explicitly tell it to target a specific key.

  • 03

    Can I use this to create new API keys?

    No. This specific MCP is built for listing and revoking existing keys, not for creation.

  • 04

    Does the AI see my Unkey password?

    No. It uses secure, encrypted connections to interact with the Unkey API via the MCP.

  • 05

    How do I know if a key was successfully revoked?

    You can ask the AI to list the keys again to verify the compromised one is gone.

  • More questions about Unkey API Management? The Connector page answers them. See everything the Unkey API Management Connector can do

Connect Unkey to Claude, Cursor, ChatGPT & more