Skip to content
WebAuditOS
Start free audit

Test your website now

Free, no card. We read only public pages.

Run free audit →

AI APIs

What is an API key, and how do you keep it secret?

An API key identifies your account to a service and often decides what you are billed. Where keys belong, how they leak, and what to do when one is exposed.

An API key is a secret string that identifies your account when your code calls a service such as an AI model, payment provider or maps API. Anyone holding it can use the service as you, at your cost. Keep keys on your server in environment variables, never in browser code or a repository, and rotate any exposed key.

Published · Last updated

By Michal Měřínský. Audit methodology.

What an API key is

When your app calls an API, the service needs to know which account the request belongs to, which limits apply and who gets the bill. An API key answers that. It is usually sent in a header:

Authorization: Bearer sk-...

Some keys are designed to be public, such as a Stripe publishable key or a Supabase publishable key, and are safe in the browser because they can only do limited, permitted things. Secret keys can do everything your account can.

How keys leak, most common first

  • Put in frontend code. Variables prefixed NEXT_PUBLIC_ or VITE_, or keys pasted into a React component, are shipped to every visitor's browser.
  • Committed to Git. A .env file or a hard-coded key pushed to a public repository is found by automated scanners within minutes. Deleting it in a later commit does not remove it from history.
  • Pasted into chats, tickets, screenshots and AI prompts.
  • Printed in logs or error messages.
  • Shared between projects and people, so nobody knows where it is used.

If a secret key was ever public, assume it was copied. Revoke it, create a new one, and check the provider's usage dashboard for activity you do not recognise.

Where keys belong

  • In server-side environment variables, set in your host's dashboard, not in code.
  • Used only by server code: an API route, a serverless function or your backend. The browser calls your server, and your server calls the provider.
  • In a secrets manager for teams and larger systems.
  • Scoped: one key per project and environment, with the narrowest permissions the provider allows.

Limit the damage in advance

  • Set spending limits or budgets with every paid provider, especially AI APIs.
  • Restrict keys by domain, IP or allowed APIs where the provider supports it, as Google Cloud does.
  • Turn on secret scanning and push protection in your repository host.
  • Rotate keys on a schedule and when people leave the project.

AI-built apps

AI app builders and code assistants often make a feature work fastest by calling an API straight from the browser with the key inline. It works in the demo and exposes the key to everyone. Ask the tool to move the call into a server function, then check the browser's network panel: no request from the page should carry your secret.

What a scan can and cannot tell you

WebAuditOS does not currently detect secret keys in your JavaScript bundles or exposed .env files. It checks related exposure, such as directory listings, error pages that leak stack traces and wide-open CORS.

To find leaked keys, use your repository host's secret scanning, a dedicated secrets scanner on your code and build output, and the providers' usage dashboards.

A clean WebAuditOS report does not mean no key is exposed. Search your built JavaScript for key prefixes before launch.

Short answers

Is an API key a password? It works like one for your account. Treat it as a secret.

Can I put an API key in my frontend? Only a key designed to be public. Secret keys belong on the server.

What do I do if I leaked a key? Revoke it immediately, create a new one and check usage.

Is a .env file safe? Locally, yes, if it is listed in .gitignore and never deployed as a public file.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

AI APIs

What is a .env file, and how do you keep it safe?

A .env file stores configuration and secrets as environment variables for local development. How it works, how it leaks, and how production handles secrets.

AI APIs

How do you get a Claude API key, and keep it safe?

How to create an Anthropic API key in the Claude Console, add credits, use it from your server, and protect it from leaking into browsers and repositories.

Hosting and deploy

What is Stripe, and how much does it charge?

Stripe processes online payments for websites and apps. What it does, its US card fees checked in November 2026, how it handles security, and mistakes to avoid.