Media API Keys in Access Logs: Check for Exposure and Rotate Safely
Tech GuruQuick Answer
Inventory where each media API key is used and whether request logs, monitoring URLs, support bundles or backups retain it. Search privately without printing secret-bearing lines into shared terminals or tickets. Restrict original evidence, publish only redacted derivatives, and rotate exposed credentials through each dependent integration. If a key is being abused, revoke it promptly even when that temporarily breaks automation; never restore an exposed key as rollback.
Request
Query strings often enter access logs; authorization headers can also leak through verbose or custom logging. Check both the application and every collection/export layer.
Log
Default or custom log formats may capture the full request URI, including query parameters.
Copy
Logs can be copied into tickets, backups, chat, dashboards, and browser history.
Rotate
Rotation is complete only when old tokens fail and all integrations use the replacement.
Decision Matrix
| Area | What to Check | Operational Standard |
|---|---|---|
| Where | NGINX/Caddy/proxy logs, app logs, browser history, uptime checks, backups | Know every retention point for token-bearing URLs. |
| What | Plex tokens, Jellyfin/Emby API keys, Tautulli API key, webhook URLs | Classify reusable secrets separately from harmless IDs. |
| Action | Redact, rotate, shorten retention, update integrations | Old keys fail and new keys are documented. |
| Evidence | Search results, rotation log, integration test | No active workflow still uses the old token. |
Start With A Token Inventory
List each app, the token name, where it is stored, what it can do, and which integrations use it. A Plex token, a Jellyfin API key, an Emby key, and a Tautulli API key are not interchangeable; each has different privileges and rotation behavior.
Use pattern searches against retained logs, exported configuration, dashboard URLs, and support bundles. Do not paste live tokens into shared spreadsheets or chat. Store the inventory in a private password manager or secrets system.
Find Query Strings In Logs
Many reverse-proxy formats log the full request URI. If the token is in the query string, the log line may hold a reusable credential. This is especially easy to miss when logs are forwarded to another host, backed up automatically, or copied into a troubleshooting ticket.
For NGINX, review the active log_format and whether it records $request_uri or $request; the latter appears in the documented combined format and includes the request target. If you need full URI logs temporarily, set a short retention and sanitize exports before sharing them.
(
set -euo pipefail
umask 077
: "${LOG_ROOT:?Set the approved local log directory}"
: "${STACK_ROOT:?Set the approved local configuration directory}"
: "${EVIDENCE_ROOT:?Set a private output parent outside both search roots}"
test -d "$LOG_ROOT"
test -d "$STACK_ROOT"
test -d "$EVIDENCE_ROOT"
OUT=$(mktemp -d "$EVIDENCE_ROOT/token-audit.XXXXXXXX")
status=0
grep -rIlZ -E 'X-Plex-Token|api[_-]?key|apikey|token=' -- "$LOG_ROOT" "$STACK_ROOT" >"$OUT/matching-files.nul" 2>"$OUT/search-errors.txt" || status=$?
if [ "$status" -gt 1 ]; then
printf 'Search incomplete; inspect restricted errors in %s\n' "$OUT" >&2
exit "$status"
fi
find "$STACK_ROOT" -type f \( -name '*.log' -o -name '*.txt' \) -print0 >"$OUT/log-text-files.nul" 2>"$OUT/find-errors.txt"
printf 'Private filename inventory: %s\n' "$OUT"
)Rotate Without Breaking The Stack
For routine rotation without suspected abuse, map consumers, pause noisy jobs, and use the application's supported replacement/revocation procedure; some applications allow only one key. Revoke a known-abused key immediately after containment instead of waiting for every consumer to migrate. Record the integration configuration and recovery steps, but do not reactivate a leaked credential to restore service.
After rotation, search for the old token string again. If it still appears in current configuration, browser bookmarks, monitoring checks, or container environment files, the rotation is incomplete.
Validation Checklist
- A search across retained log locations identifies no active files containing current token strings.
- Old tokens fail against the application API after revocation.
- Updated integrations work with the replacement token.
- Support bundles and screenshots are redacted before leaving the environment.
- Log retention and redaction rules are documented.
What This Does Not Prove
A token search does not prove a key was never copied elsewhere or used by an attacker before rotation. It proves only that the searched locations do not contain the searched values at the time of the check.
Security, Privacy, Legal, And Recovery Boundaries
- Do not publish real tokens, request URLs, media library names, user watch history, or private IP addresses.
- Do not share raw support bundles before inspecting them.
- Use lawful media services and authorized libraries only.
- Keep integration recovery notes, but never use an exposed credential as rollback. Preserve original logs and backups under restricted access and the applicable retention/incident plan; sanitize separate copies for sharing.
Search Coverage and Evidence Limits
The example requires Bash, GNU grep/find and mktemp, authorized readable local roots, and an output parent outside those roots. It lists candidate filenames, not secret values; even paths and error files may be sensitive. It skips binary files and does not unpack archives or search remote log stores. Inspect candidates with authorized private tooling, record exclusions and errors, and test each application's actual revocation behavior. No production token search or rotation was performed.
Related TechGeeks Resources
- Monitoring and Health Checks for a Plex and Arr Homelab
- Reverse Proxy Setup Without Security Mistakes
