Somebody Is Selling Your API Key to Their Customers

Somebody Is Selling Your API Key to Their Customers

Every AI video operation runs on keys. A Runway key, an OpenAI key, a Kling or Hailuo or Seedance key, a handful of others for the models that only win on one specific shot type. They live in environment files, in a CI pipeline, in a dashboard someone set up in a hurry, and often in a browser extension that a contractor installed to make resizing faster.

The standard advice about those keys is about theft. Someone gets in, uses your credits, you get a bill. Annoying, expensive, solved by rotation.

That is the old version, and it is no longer the interesting one. The current pattern is not theft for consumption. It is theft for resale — a stolen key plugged into a real business that sells inference to its own paying customers, with your account sitting quietly underneath it as the supplier of record.

What LLM-Jacking Actually Looks Like Now

The mechanics are simple enough that a small team can run it without particularly deep technical knowledge.

First, a key is obtained. Not usually by a targeted attack — more often from a leaked repository, a shared credential a contractor kept, a compromised third-party tool with legitimate access, or an extension that asked for broader permissions than its stated job required.

Second, the key goes behind a reverse proxy. This is a thin piece of software that accepts requests, forwards them upstream using the stolen credential, and returns the response. To the upstream provider, every call looks like it came from the key’s owner, because it did.

Third, and this is the step that turns a nuisance into a business, the proxy is wrapped in a product. A cheap interface, a subscription at a price no legitimate provider can match, a landing page. Because the underlying inference is being paid for by someone else, the reseller’s marginal cost is roughly zero. They can undercut list price by eighty percent and still make a healthy margin on every call.

Fourth, the bill arrives at your account.

None of these signals is exotic. Every one of them is visible in the usage dashboard you already have and probably do not read more than once a month.

The Bill Is the Least of Your Problems

An overage charge is money. Painful, recoverable, describable to an accountant.

The bigger problem is contractual. Every major provider’s terms prohibit sharing credentials or reselling access without an agreement. When an account is used as a resale upstream, the account is in violation — and the provider has no reliable way to distinguish the account holder from the person who took the key. The key was valid. The calls came from your account. From the platform’s side, you did it.

So the account gets suspended. Possibly terminated. And this does not happen on a convenient Tuesday morning with two weeks’ notice. It happens when a fraud system trips, which is to say all at once, on a Friday, mid-project.

Think about what that means for an AI video operation specifically. Your pipeline is not a single tool you can swap. It is a chain: generation model, upscaler, voice, soundtrack, edit. Those components are often on separate accounts with separate billing and separate credentials. If the account that got suspended is the one holding your generation model, everything downstream stops and every deadline in the studio is now a negotiation with a support queue.

You will also spend a week proving you are not the reseller — invoices, project files, request logs, a written statement about how the key was exposed. During which the reseller, whose entire operation was designed to survive exactly this event, moves to the next key.

Why This Hits Video Creators Harder Than Text People

The economics of resale abuse are shaped by cost per call. Text inference is cheap and getting cheaper. Video generation is not. A single high-quality clip can consume meaningful credit, and a commercial production can burn through a month’s budget in a week of iteration.

That makes video API access unusually attractive to a reseller. Fewer requests to make real money, and a customer base — small studios, solo creators, agencies in price-sensitive markets — that is genuinely desperate for cheaper generation and often cannot buy direct because of payment friction or regional restrictions.

You are the subsidy for that market. Your paid credits make their pricing possible.

There is a second-order effect worth naming. Resale traffic competes for the same rate limits as your legitimate work. So before you ever see a suspicious charge, you may notice that renders are queuing longer, requests are getting throttled at hours when your own usage is low, or a model that used to respond instantly is now taking twenty seconds. Most teams chalk that up to provider congestion and stop looking. The congestion has a cause and the cause has your key in it.

The Counter-Argument You Should Take Seriously

Here is the honest version of the other side: most credential exposure is not a criminal operation. It is you.

A contractor handed your key to a tool so they could hit a deadline. An analytics extension asked for API access and a tired person clicked allow. A “free wrapper” app that generates thumbnails required a key at signup and stored it in a place nobody ever looked at again. A key from a 2024 experiment is still live because nobody remembered to revoke it.

In a large share of real incidents, the abuse pattern is not a sophisticated reseller at all — it is a forgotten integration quietly burning budget, or a team member’s personal side project running on the company account. The distinction matters, because the mitigation is different: for theft you need detection, for sprawl you need inventory.

There is also a fair objection to the panic framing. Providers know resale abuse exists and most have fraud detection that catches obvious patterns. Many will work with a legitimate account holder who reports a compromise quickly and can show what happened. Being the victim of a stolen key is not, in most cases, the end of a business relationship — being the victim who discovered it three months late and never reported it is much worse.

Which points at the actual lesson. The problem is not that thieves are clever. The problem is that most accounts have no ceiling, no inventory and no alert, so a stolen key can run for weeks before anyone notices, and a forgotten key can run for years.

Key Hygiene as a Production Discipline

The fix is unglamorous and most of it can be done in an afternoon. It works because it makes the two failure modes — theft and sprawl — visible.

If you do only one thing, do the spend-velocity alert. A cap stops the bleeding at a fixed number; an alert tells you it is happening while you can still report it cleanly and preserve the account. The difference between an incident you handled and an incident that handled you is usually the number of days before someone looked.

What to Do the Day You Suspect It

Sequence matters here, because the instinct — revoke the key immediately — is right but incomplete.

Export the usage logs first. Revoking access is the first thing you want to do and the last thing you should do before preserving evidence. Pull request logs, timestamps, IPs, model breakdowns. Screenshot the dashboard. You will need this to prove what happened, and providers often retain logs for a limited window.

Then revoke, and rotate everything on the same account. Not just the exposed key. If one credential leaked, assume the neighbouring ones are unknown rather than safe.

Then report to the provider proactively. Not a support ticket that says “why is my bill high” — a written account: what you found, when, what you have already done, and what evidence you hold. Providers treat a self-reported compromise very differently from an account that got flagged by their fraud system and stayed silent.

Then find how it left. Repo history, contractor handoffs, installed extensions, third-party integrations with stored credentials. If you rotate keys without finding the exit, you will be back here in a month with a fresh key sitting in the same place.

Then check what else was on that account. Billing details, team access, webhooks pointing at addresses you do not recognise. A stolen key is often the visible symptom of a wider access problem.

Where This Goes

Model access is becoming an operating expense for creative businesses, and anything that is an operating expense gets arbitraged. The grey market for inference is not going away — it will get more organised, better hidden, and more aggressively priced as generation models commoditise.

That means the operators who survive it are not the ones with the cleverest detection tooling. They are the ones whose accounts have ceilings, whose keys are inventoried, and whose dashboards get read by a person who knows what normal looks like.

The uncomfortable truth is that your API key is a bearer instrument. Whoever holds it is you, as far as the platform is concerned — including when they are selling your model access to customers you will never meet, at prices you are quietly funding.

You cannot stop someone reselling what they stole. You can make sure it is unprofitable and short-lived by the time they try.

Frequently Asked Questions

What is LLM-jacking? LLM-jacking is the unauthorized use of someone else’s language model or image-generation access through stolen credentials. The current form is not just free personal use — a stolen API key is placed behind a reverse proxy and wrapped in a product that is sold to paying customers, so the legitimate account holder funds the reseller’s business. It affects video and image generation accounts as much as text models, because higher cost per call makes the resale more profitable.

How would I know if my API key is being resold? Look for continuous round-the-clock usage when your team works standard hours, call volumes with no corresponding projects, model calls for models your workflow never uses, sustained concurrency from many clients, and traffic originating in regions you do not operate in. Rate-limit throttling during your own low-usage hours is an early warning that often appears before the bill does.

Will my account get banned if someone steals my key? It can be suspended or terminated. Provider terms prohibit credential sharing and unauthorized resale, and the platform cannot reliably tell the account holder from the thief — the key was valid and the calls came from your account. Reporting the compromise proactively with logs, before the provider’s fraud systems flag it, materially improves how the situation is handled.

Is the overage charge the biggest cost? No. The overage is recoverable money. The larger costs are account suspension that halts a production pipeline mid-project, time spent proving you are not the reseller, potential loss of prepaid credits, and reputational damage if client work misses deadlines. For a studio, a week of downtime can exceed the fraudulent charges themselves.

What is the single most effective control? A spend-velocity alert. A hard cap limits the damage, but an alert tells you it is happening within hours rather than weeks, which is the difference between a reported incident and an unreported one. Pair it with separate keys per project so a single leak cannot compromise every workflow simultaneously.

Does this apply to small creators or only to agencies? Both, for different reasons. Agencies have more keys and more contractors, so more chances to leak. Small creators are more likely to have one key shared across tools, stored in a wrapper app, or left live from an old experiment — and less likely to have anyone watching the dashboard. The controls are the same at both scales and none of them require an IT department.