Apify rotates API tokens and forces 2FA resets after breach

Apify has rotated critical internal secrets and prompted customers to reset two-factor authentication after detecting unauthorised access to its internal systems, according to a report published by BleepingComputer on 12 November 2026.

As part of the response, the company also revoked some third-party OAuth connections, the report said. OAuth connections are the links that let one service act on a user's behalf in another, so revoking them breaks any automation that depended on those tokens until the connection is re-approved.

The practical effect for customers is immediate. Rotating API tokens invalidates the old ones, which means any script, scheduled job or agent that authenticated with a stored Apify token will stop working until the new token is put in place. The same applies to the revoked OAuth links. Two-factor authentication resets require users to re-enrol their authenticator app or second factor before they can log back in.

The reported response pattern — rotating internal secrets, resetting second factors and cutting third-party connections — is the standard playbook for a company that cannot yet rule out that credentials were exposed. It is a precaution as much as a remedy, and it does not by itself confirm that any customer data or token was misused.

The available reporting does not say how the attackers obtained access, when the unauthorised access began, how long it lasted, or how many customers were affected. Nor does it set out what data, if any, was taken. The root cause remains unknown on the public record, and the incident should be read as confirmed but thinly documented.

For teams that build automated browsing and scraping workflows, the exposure point is the token itself. Platform credentials are typically stored in continuous integration systems, secret managers, serverless environment variables and local developer machines, and a rotation event surfaces every copy that was never tracked. Organisations affected by the resets will need to find those copies, replace them and check whether any jobs failed silently in the interim.

Apify customers should follow the company's own notifications for the authoritative list of what was rotated and what needs to be re-authorised. The Agentic Times will update this story if Apify publishes further detail on the cause or scope of the intrusion.