Revoke Leaked

For instructions on how to authenticate to use this endpoint, see API overview.

Endpoints

POST

Create revoke leaked key

Public, unauthenticated endpoint for self-service revocation of a leaked PostHog personal API key, project secret API key, legacy feature flags secure API key, or OAuth access/refresh token. If the token matches a real credential, it is revoked immediately and the owner is notified by email. This includes an expired OAuth access token: the paired refresh token it protects may still be live. A legacy feature flags secure API key is matched through its migrated project secret API key row; it cannot be rotated automatically, so its project admins get an email to rotate it.

This endpoint only checks the region it is running on. "found": false does not guarantee the token is safe. If you're not sure which region issued it, check both: https://app.posthog.com/api/revoke_leaked_key and https://eu.posthog.com/api/revoke_leaked_key.

Request parameters

  • token
    string

Response


Example request

POST /api/revoke_leaked_key
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/revoke_leaked_key/\
	-d token="string"

Example response

Status 200 Lookup result.
RESPONSE
{
  "found": true,
  "type": "personal_api_key"
}
Status 400 The token is missing, blank, or longer than 200 characters.
Status 429 Too many requests from this IP.

Create revoke leaked key

Public, unauthenticated endpoint for self-service revocation of a leaked PostHog personal API key, project secret API key, legacy feature flags secure API key, or OAuth access/refresh token. If the token matches a real credential, it is revoked immediately and the owner is notified by email. This includes an expired OAuth access token: the paired refresh token it protects may still be live. A legacy feature flags secure API key is matched through its migrated project secret API key row; it cannot be rotated automatically, so its project admins get an email to rotate it.

This endpoint only checks the region it is running on. "found": false does not guarantee the token is safe. If you're not sure which region issued it, check both: https://app.posthog.com/api/revoke_leaked_key and https://eu.posthog.com/api/revoke_leaked_key.

Request parameters

  • token
    string

Response


Example request

POST /api/revoke_leaked_key
export POSTHOG_PERSONAL_API_KEY=[your personal api key]
curl 
    -H 'Content-Type: application/json'\
    -H "Authorization: Bearer $POSTHOG_PERSONAL_API_KEY" \
    <ph_app_host>/api/revoke_leaked_key/\
	-d token="string"

Example response

Status 200 Lookup result.
RESPONSE
{
  "found": true,
  "type": "personal_api_key"
}
Status 400 The token is missing, blank, or longer than 200 characters.
Status 429 Too many requests from this IP.