← Retour aux guides

API Key Leaks: 9 Common Mistakes and Fixes

API keys are credentials, not configuration details. If an attacker obtains one, they may be able to consume your paid quota, access private data, or use your account for abuse. The most damaging leaks are often caused by ordinary development shortcuts rather than sophisticated attacks. This guide covers common mistakes and the practical controls that prevent them.

1. Putting keys directly in source code

A key inside JavaScript, Python, a Dockerfile, or a configuration file can spread through Git history, forks, pull requests, and downloaded releases. Deleting the line later does not remove it from old commits.

Store credentials outside the repository and load them at runtime. For local development, use an ignored .env file or a password manager. Add secret files to .gitignore, commit a safe template such as .env.example, and scan the repository before every release. If a key has ever been committed, treat it as compromised: revoke it, issue a replacement, and remove it from Git history with a tool such as git-filter-repo.

2. Shipping a secret in frontend code

Environment variables do not automatically make a browser application secure. Build systems often embed variables prefixed for client-side use into the final JavaScript bundle, where anyone can inspect them.

Keep provider credentials on a server you control. The browser should call your backend, and the backend should authenticate the request, enforce user limits, and call the model API. Never rely on obfuscation, hidden fields, or minified JavaScript to protect a key.

3. Exposing keys in logs and error messages

HTTP headers, request bodies, exception objects, and debug output can end up in application logs, monitoring platforms, support tickets, or chat messages. A failed request can therefore create a second leak.

Redact authorization headers and known secret patterns before logging. Log a request ID, provider, model, status code, and latency instead of the complete request. Review third-party observability tools and set short retention periods for sensitive traces.

4. Forgetting CI/CD and build systems

Continuous integration jobs commonly print shell commands, dependency-install output, and environment values. Pull requests from untrusted contributors can also run code in a dangerous context.

Use your CI platform's encrypted secret store, disable command echoing around sensitive steps, and grant secrets only to trusted branches and jobs. Prefer short-lived credentials where supported. Prevent secrets from being passed to tests or build steps that do not need them.

5. Using one unlimited key everywhere

A single key shared by production, staging, local laptops, and contractors makes incidents difficult to contain. One compromised laptop can expose every environment.

Create separate keys per application, environment, and team when possible. Apply the smallest available permissions, set spending or request limits, and restrict allowed models or endpoints if the provider supports those controls. Label keys so unusual usage can be traced quickly.

6. Ignoring developer tools and shell history

Keys pasted into command-line arguments may be stored in shell history or appear in process listings. They can also remain in IDE task files, terminal recordings, screenshots, and issue comments.

Pass secrets through environment variables or a secret manager rather than command arguments. Review shell history after an accidental paste, delete exposed credentials immediately, and avoid sharing raw terminal output in public channels.

7. Failing to rotate after a suspected leak

Rotation is not merely changing a variable name. Revoke the old credential first, create the replacement, update every dependent service, and verify that old requests fail. Then inspect usage, billing, and access logs for activity between exposure and revocation.

8. Choosing an expensive setup without checking alternatives

Security and cost controls should work together. A pay-as-you-go relay such as 59API can provide access to Claude Opus, Sonnet, Haiku, and Fable, plus GPT models, without requiring developers to manage multiple provider integrations. It uses native official-quality models rather than downgraded substitutes and is compatible with Claude Code, Codex, and OpenAI SDK-based applications.

For a server-side integration, keep the 59API credential in your secret store and point your client to https://api.59api.com as the API base URL. Use separate credentials for development and production, set application-level budgets, and monitor usage even when the relay is one of the cheapest pay-as-you-go options. A referral rebate may also reduce costs for teams that invite other developers.

9. Treating monitoring as optional

Prevention can fail, so detection matters. Alert on sudden traffic spikes, unfamiliar regions, unexpected model usage, repeated authentication errors, and spending above normal levels. Keep an incident checklist with the steps to revoke keys, identify affected systems, notify stakeholders, and review logs.

If you need affordable model access without putting provider credentials in client applications, consider signing up for 59API and configuring it behind your own backend. The safest API key is one that is isolated, limited, monitored, and easy to revoke.