Revoke and undo

Pro and Business can act on a leaked key: revoke or rotate at 8 providers, report to 2, or send to your own system. Every plan still finds the leak and gives the fix.

ShellOrbit never uses a key it finds, not even to test it, and never stores one in full. It acts only through credentials you give it, after ten minutes in which you can cancel.

Providers

Alert only, with the fix and a link to the provider’s own steps: Stripe, xAI, Slack, GitLab, npm, PyPI, Docker Hub, Cloudflare, Vercel, Netlify, Heroku, DigitalOcean, Mailgun, Resend, Datadog, Replicate, Groq, Doppler, Sentry, Shopify, Mapbox, Telegram, Linear, Notion and Discord. None offers a way to find one key without using the leaked key itself. Send them to your own system if you want them handled automatically.

Connect an account

Settings, Connected accounts. Owners and admins only. ShellOrbit tests the credential with a read only call before saving it. Each credential is encrypted, never shown again, and deleted when you disconnect. Use a dedicated credential with only the permissions below.

AWS

Create a role named ShellOrbitLeakAlarmRevoke that trusts ShellOrbit’s AWS account with the external id shown on the page, attach only this policy, and paste the role ARN:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "FindTheLeakedKey",
      "Effect": "Allow",
      "Action": ["iam:ListUsers", "iam:ListAccessKeys"],
      "Resource": "*"
    },
    {
      "Sid": "DeactivateTheLeakedKey",
      "Effect": "Allow",
      "Action": "iam:UpdateAccessKey",
      "Resource": "arn:aws:iam::*:user/*"
    }
  ]
}

The key is matched by the finding’s fingerprint. Deactivation is reversible in IAM.

OpenAI

Paste an admin key from your organization’s Admin keys. The key is matched on its redacted value and deleted only when exactly one project key matches. Keys owned by users or service accounts are reported, not deleted.

Anthropic

Paste an Admin API key (sk-ant-admin01-) from Console, Settings, Admin keys. Only an admin key can turn other keys off. ShellOrbit lists your API keys, matches the leaked one on Anthropic’s partial key hint, and sets it to inactive only when exactly one key matches. You can reactivate it in the Console. A leaked admin key is alert only.

Google Cloud

Create a service account in the project, give it a custom role with only these permissions, then paste its JSON key:

apikeys.keys.lookup
apikeys.keys.get
apikeys.keys.delete
iam.serviceAccountKeys.get
iam.serviceAccountKeys.disable

• API keys (AIza..., including Firebase and Maps keys). Google identifies an API key only from the key itself. With Google Cloud connected, ShellOrbit sends a key it finds to Google’s own key lookup, as data, never as a credential, and keeps only the key’s resource name. It never deletes an API key on its own, because many Google keys are meant to be public, such as browser Maps keys: you press Revoke, and the key is deleted after the ten minutes. Google can restore a deleted key for 30 days.
• Service account keys (a leaked JSON key file). ShellOrbit reads the key id and service account email from the finding and disables that key. You can enable it again in IAM.

Azure

Create an app registration with a client secret and paste the tenant id, client id and secret.

• AI services and Azure OpenAI keys. Give the service principal a custom role on the resource group with Microsoft.CognitiveServices/accounts/read, Microsoft.CognitiveServices/accounts/listKeys/action and Microsoft.CognitiveServices/accounts/regenerateKey/action. ShellOrbit lists key1 and key2, compares them in memory with the leaked key’s fingerprint and never stores them, then regenerates the one that matches. Regenerating breaks your app until it uses the new key, so this always asks you first and never runs automatically.
• App client secrets. Grant Application.ReadWrite.OwnedBy and make the service principal an owner of the app. Microsoft shows only the first 3 characters of a secret, so ShellOrbit removes it only when exactly one secret on the app matches; otherwise it alerts.

Twilio

Paste a Main API key (SID and secret), or the Account SID and Auth Token. ShellOrbit finds the leaked API key by its SID and deletes it.

SendGrid

Create an API key with the API Keys permission only and paste it. ShellOrbit finds the leaked key by its id and deletes it. SendGrid can take a moment to apply the deletion.

Supabase

Paste an access token and the project ref. ShellOrbit only ever sends the statement that turns on Row Level Security, only for tables in that project. A leaked Supabase secret key is alert only for now; rotate it in Supabase.

GitHub

Turn on reporting. Nothing is stored. From then on, every new GitHub token a domain scan finds is reported to GitHub’s revocation service at once.

Hugging Face

Turn on reporting. Nothing is stored. A Hugging Face token a scan finds is reported to Hugging Face’s revocation service at once; Hugging Face revokes it and emails its owner.

Choose per key

Every new connection asks you first. Then either:

• press Revoke (or Lock table for Supabase) on a finding, or
• open Manage on the connected account and turn on acting automatically, with ten minutes to cancel. Azure AI services keys always ask first.

Revoke shows only on findings a connected account, or your webhook, acts on. With nothing connected, findings carry the fix and no revoke.

Cancel revoke stops it and marks the key alert only.

What happens

1. The revoke is scheduled ten minutes out, you are alerted, and the finding shows a countdown.
2. Cancel any time in those ten minutes.
3. ShellOrbit acts on the exact key or table, then confirms with the provider.
4. You are alerted with the result. A revoked key still in your code stays a finding and is never revoked twice.

If the provider refuses, or more than one key could match, nothing changes and you are told why. Every step is in the audit log.

Reports have no ten minutes: GitHub and Hugging Face tokens are reported the moment a domain scan first finds them, and cannot be reactivated. Tokens found before reporting was on, or seen only through the SDK or a log drain, show the fix for you to revoke yourself.

Before you allow it

Revoking a key your app still uses takes that part down, and locking a table can block your app until you add policies. Rotate first: deploy the new key, then let ShellOrbit revoke the old one.