You pasted an API key into a coding session. Now what?

Deleting the chat does not remove it. Where the key actually lives, how to find every session that contains one, and what to do in what order.