Credential stuffing
Credential stuffing is an automated attack where leaked username-password pairs, or in some cases leaked API keys, from one breach are tried against many other services, on the assumption that people reuse the same credentials in more than one place.
Why it matters
This is one of the strongest arguments for never reusing an API key across unrelated services or projects: a leak in one place should not become an opening everywhere else.
Does credential stuffing apply to API keys, not just passwords?
Yes, if the same key or a similarly reused secret grants access somewhere else, it is vulnerable to the same pattern.
How do I protect against credential stuffing?
Use a unique credential per service, and rotate or revoke anything involved in a known breach immediately.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.