Keys get committed to repositories, pasted into shared documents, and left in an agent's task instructions that someone else can read. When it happens, speed matters more than diagnosis.
- Revoke the key immediately. Profile then API keys, revoke. It takes effect at once and the next request using it fails with a 401.
- Create a replacement and copy it straight into your secret store. Keys are shown once, so treat the creation screen as the only chance.
- Update the one place that used it. This is why one key per agent or integration is worth the discipline: with separate keys, a revocation breaks exactly one thing.
- Check your balance and spend under Profile then Billing. Every spend is logged, so an unexplained drop is visible.
Two structural protections limit the damage in the meantime. Spending is enforced server-side against your balance, so a leaked key can never spend more than you hold. And scopes are separate: a key issued without spending scopes can read counts and previews, which are free anyway, and nothing else.
If you are unsure whether a key was used by someone else, write to support@argorant.com with the key's name, not the key itself, and roughly when you think the exposure happened.
Prevention that actually works: read-only keys wherever a spend is not required, and a fresh key per environment rather than one shared across dev and production.