Storing API Keys for AI Apps Securely

Server environment variables or a secret manager — never client JavaScript, mobile bundles, query strings or git history. Browser calls go to your backend route, which adds the key and calls the API. Check CI artifacts, docker history and HTTP-client exception texts too: secrets leak there most often.

Name keys by purpose and date, keep environments split from day one: prod, test, bot, experiments. Quarterly review of dangling keys: ex-contractor keys are the classic silent hole.

A spend limit per key is the emergency brake: exhausted means failed requests, not an empty balance. Rotate on personnel changes: issue new, verify, revoke old. Keep the old key briefly for rollback, then revoke.

On suspected leak revoke and reissue immediately — a found bot key is spent within hours since bots are searchable. Then find the leak path before issuing the replacement, or history repeats.

Log statuses and request IDs, never keys or contents. Masking catches the obvious and misses scans and screenshots — attachments go by metadata (name/size/hash) only. Full keys must not appear even partially: prefixes help restore them too.

Separate prod, test and experiment spending by key: with split keys the bill explains itself, and incidents stay contained to one direction.