What do I do if an API token leaks?
Revoke the token under My Settings, API, create a new one, and check the usage page for requests you did not send.
Revoke it at once under My Settings, API. Revocation takes effect with the next request, and a revoked token cannot be restored. Then create a new token and put it into your application.
My Settings, Usage shows the requests of each token by endpoint, with the time of the last call. Compare it with what your own systems sent. Requests you cannot explain belong in a message to [email protected], since they may have spent credits.
A leaked token cannot create further tokens, because token management requires a signed-in browser session. Keep tokens out of source code and URLs, and give each application its own token with an expiry date.