agentiQu

If an Agentiqu key or token leaks

Agentiqu is a GitHub secret scanning partner. GitHub scans public repositories, gists, issues and other public content for Agentiqu credentials. When GitHub finds one, GitHub reports it to Agentiqu. Agentiqu then revokes the credential automatically.

Credentials that Agentiqu revokes

  • Secret API keys. These keys start with agt_sk_…. Older keys start with agt_….
  • OAuth tokens for the Agentiqu connector in an MCP client. These tokens start with agort_… or agoat_…. A leaked OAuth token revokes the whole connection, so all of its tokens stop working.

After the revocation, the leaked credential does not work.

What to do after a leak

  1. API key: create a new key in Settings → API keys in the Agentiqu dashboard. If you use the CLI or the MCP connector with a key, sign in again.
  2. OAuth token: reconnect the Agentiqu connector in your MCP client. The client then gets new tokens.
  3. Store the new credential in a secret manager or a CI secret. Do not put it in code.
  4. Remove the leaked value from the repository and from its git history. A value in an old commit is still public.
  5. Check the runs, simulations and credit usage of your organization for the time of the leak. To get the revocation record, email hello@agentiqu.com.

Publishable keys

Publishable keys start with agt_pk_…. They are public by design. Agentiqu does not revoke them.

Contact

For questions about a leaked credential, email hello@agentiqu.com.