What should I do if the API key in my WordPress plugin is lost or exposed?

Rotate it. On the integration’s Activity screen in BytePhase, click Rotate key and copy the new key, which is shown once. The old key stops working immediately. Paste the new one into BytePhase → Connection in WordPress. Submissions made in the meantime are queued by the plugin and delivered once the new key is saved. In WordPress the key is masked after saving and never logged.