If an API key appeared in a public repository, URL, screenshot, browser bundle or conversation, treat it as exposed. Removing the visible copy alone does not make the key safe.
Respond from your workspace
Sign in directly at oddswire.io/app.
An owner or admin should revoke or rotate the affected key in API keys.
Store the replacement securely and update every application or host that used the old value.
Inspect Usage for unexpected activity and contact support with redacted request IDs and times.
Oddswire supports one active key per account. Rotation replaces the previous key and may interrupt integrations until they are updated. Revocation also blocks MCP data calls that rely on the workspace’s active key.
Preserve useful evidence
Keep the approximate exposure window, affected integration names and request IDs. Do not paste the leaked value into a new support message. Remove credentials from shared examples and secret-bearing logs using your own organization’s process.
Key replacement does not reset credits or broaden data permissions. If your workspace login may also be compromised, use the account provider’s recovery/security flow and contact support. Never send a password or verification code.