Go to Settings > API & Webhooks and click “Revoke” next to the key — this takes effect immediately and any requests using the old key will start failing right away. Then generate a new key and update it in whatever integration was using the old one. If you have a moment, also worth double checking your repo's commit history — removing the key from the latest commit doesn't remove it from git history, so if the repo is public, consider it compromised regardless and treat the rotation as the actual fix, not just cleaning the file.