Copied an API Key or .env File? What to Do Next

Copying an API key is not automatically a leak; copying is how most keys get from a dashboard into a config file. What matters is where the copy went. If it only sat on your clipboard and you pasted it where you meant to, clear it from clipboard history and move on. If it synced to the cloud, landed in a chat, a ticket, a commit or a screen share, treat the key as exposed: rotate it first, then clean up the copies.

Clean up or rotate? Check where the key went

The rule behind the table: once a secret has been stored somewhere you don't control, or seen by people who shouldn't have it, deleting the copy can't take it back. Only revoking the key does that, which is why OWASP's secrets management guidance calls for revoking and replacing an exposed secret quickly, then removing it from wherever it was exposed.

Step 1: Rotate the key

Rotation means issuing a new key and revoking the old one. Do it from the provider's console, not by editing the key you have.

AWS access keys

AWS recommends this order for IAM user access keys, and allows at most two keys per user:

1. In the IAM console, open Users, choose the user, and open the Security credentials tab.
2. Choose Create access key while the old key is still active.
3. Update every application and tool to use the new key.
4. Choose Actions > Deactivate on the old key and confirm that everything still works.
5. Delete the old key.

For a routine rotation AWS suggests waiting before you deactivate. For a key that has leaked, deactivate it as soon as the new one is in place.

GitHub personal access tokens

Go to your profile picture > Settings > Developer settings > Personal access tokens, choose Fine-grained tokens or Tokens (classic), and click Delete next to the exposed token. Then create a replacement with the same scopes. If the token reached a public GitHub repository, GitHub's secret scanning notifies supported providers about detected partner secrets so they can act, such as by revoking them.

Stripe API keys

On the Stripe API keys page, open the overflow menu (⋯) for the key and choose Rotate key. In the Expiry dropdown, choose Now to delete the old key immediately. Any later expiry keeps the old key working until then, which helps planned rotations but not a leaked key.

Everything else

Most providers offer revoke and regenerate in their dashboard or API settings. For a database password, change it on the server and update the connection string wherever it's used. Check the provider's access or audit logs for use of the old key while it was exposed.

Step 2: Remove the copies

Windows clipboard and clipboard history

1. Copy any harmless text so the key is no longer on the live clipboard.
2. Press Win+V, select See more (...) next to the key, and choose Delete. If you pinned it, unpin it first.
3. If sync was on, open Settings > System > Clipboard and select Clear clipboard data > Clear. This removes clipboard data on the device and in the cloud, except pinned items.

Microsoft documents that clipboard sync covers text, which includes keys. Turn sync off on machines that handle production credentials: how to disable Windows clipboard cloud sync walks through it, and how to clear clipboard history on Windows 11 covers every clear option.

Clipboard managers

Delete the entry in each manager you run, since each keeps its own copy on disk. In Edge Drop, delete the card, or use the clear menu for a time window; deleting also wipes the system clipboard if it still holds that content. Bulk clears skip pinned items, so unpin first.

Edge Drop encrypts its history index with Windows DPAPI, but text clips longer than 300 characters, such as a whole .env file, are stored as plain text files under %APPDATA%\Edge-Drop\payloads. Where Edge Drop stores data on disk lists every file.

Chat, tickets and repositories

Delete the message or comment after rotating, not instead of it. For a repository, scan the full history so you find every copy:

gitleaks git -v

Gitleaks reads the history with git log -p and reports anything that looks like a credential.

Step 3: Stop putting secrets on the clipboard

The clipboard is readable by any desktop app running in your session, and every clipboard history tool is designed to remember what passes through it. Can other apps read everything you copy? explains the first part. The fix is to give secrets a path that skips the clipboard:

• Inject secrets at runtime. With 1Password's CLI, an env file holds references such as op://development/aws/Access Keys/access_key_id instead of values, and op run --env-file="./prod.env" -- your-command resolves them only for that process. HashiCorp Vault and the cloud providers' secret managers do the same job for servers and CI.
• Use your password manager's autofill for web dashboards instead of copy and paste. If you must copy, 1Password's desktop app can remove copied items from the clipboard after 90 seconds (Settings > Security).
• Pause capture while you handle secrets. Many password managers mark their copies with Windows' "exclude from clipboard history" formats, and Edge Drop honours those formats and known password-manager formats. A key copied from a web page or a text file carries no such mark, so turn on Edge Drop's Incognito mode first; how to pause clipboard capture covers other managers.

Keep .env files off the clipboard

A .env file is a list of secrets in one place, so copying the whole file exposes all of them at once. Share the shape of the file, not the values:

1. Add .env to .gitignore so it is never committed.
2. Commit a .env.example with the same variable names and obvious placeholder values.
3. A new developer copies .env.example to .env and fills in real values from the team's password manager or secret store.

To load variables per project without pasting them into a shell, direnv loads an .envrc file when you enter a directory and unloads it when you leave. Run direnv allow once to approve the file, and add a dotenv line to .envrc if you also want it to read .env. direnv targets Unix-like systems, so on Windows run it inside WSL.

When a teammate needs a real value, send it through your password manager's sharing feature or the secret store, not chat or email. Stripe's own key guidance says the same: don't share keys over email, chat or other unencrypted channels.

FAQ

Does Windows clipboard history save API keys?

Yes, if clipboard history is on and the app you copied from didn't mark the copy as excluded. The key stays among the last 25 items until you delete it or restart, or indefinitely if you pin it.

Is clearing the clipboard enough?

Only if the key never left your PC. Clearing doesn't reach a cloud copy made before you cleared it, other clipboard managers, or anywhere you pasted it.

Do test keys need rotating too?

A test or sandbox key can't touch production data, so the urgency is lower. Rotate it anyway if it reached a public place, since it still grants access to your test environment.

Related reading

• How to Stop Clipboard Managers From Saving Secrets
• How to Redact Tokens From Stack Traces Before Sharing
• Pair Programming: Keep Secrets Out of Clipboard History
• How Do Passwords End Up in Clipboard History?

Sources

• Secrets Management Cheat Sheet (OWASP) — revoke and replace exposed secrets; remove them from exposed systems.
• Update access keys (AWS IAM User Guide) — create, update, deactivate, then delete.
• Manage access keys for IAM users (AWS IAM User Guide) — maximum of two access keys per user.
• Managing your personal access tokens (GitHub Docs) — deleting a token.
• About secret scanning (GitHub Docs) — providers notified about detected partner secrets.
• API keys (Stripe Docs) — Rotate key, the Expiry option, and not sharing keys over chat or email.
• Gitleaks (GitHub) — the gitleaks git command.
• Load secrets into the environment (1Password CLI) — op run with secret references.
• Copy passwords and other details (1Password Support) — removing copied information after 90 seconds.
• Vault documentation (HashiCorp) — centralised secret management.
• direnv (GitHub) — .envrc, direnv allow, dotenv.
• Ignoring files (GitHub Docs) — .gitignore.
• Using the clipboard (Microsoft Support) — deleting items, Clear clipboard data, and text sync.
• Clipboard Formats (Microsoft Learn) — formats apps use to keep data out of history.

Copy. Stack. Drop.

Transform your clipboard into an interactive edge shelf. Stack, pin, and drag assets into any app with zero friction.

Download for Windows Get from Microsoft Store

How to Install Guide · First 10 Minutes Guide · Drag & Drop Guide · Edge Drop vs Win+V · Support