← Voltar aos guias

API Key Leak Troubleshooting: A Developer’s Playbook

Secure API Keys Before Your First Request

An API key is a bearer credential: anyone holding it may be able to make requests and spend your balance. Securing API keys means controlling where they live, where they travel, and how quickly you can revoke them. These steps apply whether you use an AI provider directly or an API relay such as 59API.

Problem: Your Key Appears in Frontend Code

Fix: move authenticated requests to your backend. Anything delivered to a browser—including bundled JavaScript, source maps, and network requests—is inspectable. A frontend environment variable does not become private just because its name contains “SECRET.”

• Store the key in a server-side secret manager or a deployment platform’s encrypted secret settings.
• Have your frontend call an authenticated backend endpoint that makes the AI request.
• Apply per-user quotas, request-size limits, and allowed-model rules. Otherwise, your backend can become an unauthenticated spending proxy.
• Keep secrets out of public build variables such as NEXT_PUBLIC_* and VITE_*.

Problem: A Key Was Committed to Git

Revoke the exposed key immediately. Deleting the line or making the repository private does not invalidate copies. Treat credentials pushed to a public repository as compromised, even if exposure lasted seconds.

• Revoke the key through the provider’s key-management controls; contact support if you cannot revoke it yourself.
• Create a replacement and update affected deployments through your secret store.
• Review usage, billing, and available request logs from the earliest possible exposure time.
• Remove the secret from current files and repository history using a tool such as git-filter-repo. Coordinate rewritten history with collaborators.
• Scan all branches and history with a secret scanner such as Gitleaks. Check CI artifacts, container images, and copied snippets too.

Add local secret files to .gitignore before creating them. Git ignores do not protect files already tracked. Commit an .env.example containing placeholders, and enable pre-commit scanning plus repository push protection where available.

Problem: Requests Return 401 or 403

A 401 commonly indicates missing or invalid authentication; a 403 often indicates a permission or policy restriction. Exact meanings vary by service. Check these before pasting credentials into a support ticket:

• Confirm the running process received the current key. Restart or redeploy services that read environment variables only at startup.
• Check for trailing newlines, accidental quotation marks, or an outdated secret version.
• Verify the destination host, required API path, and authentication header against the provider’s instructions. Never test a real key against an unfamiliar endpoint.
• Check model access and account status. A 429 more often points to rate limits or quota than an invalid key.

Share sanitized error messages and request IDs, not complete request dumps. Redact Authorization and x-api-key headers, URL credentials, and sensitive payloads.

FAQ: Where Should Production Keys Live?

Prefer a managed secret store with access controls and audit logs. Inject secrets at runtime rather than embedding them in source files or container images. Environment variables are convenient, but debugging tools, crash dumps, and overly broad process access can expose them.

FAQ: How Often Should I Rotate Keys?

Rotate immediately after suspected exposure, staff access changes, or accidental sharing. For planned rotations, create a new key, deploy it, verify successful requests, then revoke the old one. Use separate keys for development, staging, and production where supported, so one incident does not affect every environment.

FAQ: Can Low-Cost AI Access Still Be Secure?

59API offers cheap, pay-as-you-go access to Claude and GPT models with native, official-quality models and no downgrade. It supports Claude Code, Codex, and OpenAI SDKs, using the API base URL https://api.59api.com. Its low pricing and referral rebate can help stretch a development budget.

With any relay, assess its data-handling policies, access controls, and incident support. Configure spending limits and alerts where available; alerts alone do not stop charges. If that setup fits your project, consider signing up for 59API and starting with a separate development key and a small budget.

Preços · Docs