Secure API Keys: From Local Setup to Production
An API key is a password for software: anyone who gets it may be able to make requests and spend your account balance. The safest approach is to keep keys on trusted servers, limit access, and have a plan to replace a key quickly if it leaks. Use these steps to protect a new integration from your first local test through production.
1. Create a key and keep it out of your code
Generate an API key in your provider’s dashboard and treat it as a secret from the moment it appears. Do not paste it into source files, documentation, screenshots, support tickets, or chat messages. Avoid putting it in a command-line argument, which may be saved in shell history or exposed in process listings.
For local development, load the key from an environment variable. A local .env file can be convenient, but add it to .gitignore before creating it. Commit a .env.example file containing variable names only, such as API_KEY=. Check that the real file is not tracked with git status. Git ignore rules do not remove a secret that was already committed.
2. Keep the key on the server
Never embed a private API key in browser JavaScript, a mobile app, or a public repository. Minification and obfuscation do not make it private; users can inspect network requests and application files. Instead, have your frontend call your own backend, and let that backend call the AI provider. Authenticate users, validate their inputs, and apply rate limits on your server so your endpoint cannot become an unrestricted proxy.
For production, store secrets in your cloud provider’s secret manager or deployment platform’s encrypted secret settings. Grant access only to the application or deployment job that needs the key. Keep development, staging, and production credentials separate, and use different keys for separate services where possible.
3. Configure the client without printing secrets
Read the key from the environment at startup and fail clearly if it is missing. Configure your SDK with the provider’s documented API base URL and keep the key in its authentication setting; do not build it into a URL. For example, 59API uses https://api.59api.com as its base URL and is compatible with OpenAI SDKs, Claude Code, and Codex. Follow the relevant client’s setup instructions, and verify that your request uses the intended model and endpoint before deploying.
When choosing a relay, compare both price and model behavior. 59API offers pay-as-you-go access to Claude Opus, Sonnet, Haiku, and Fable, as well as GPT models. Its low-cost access uses native, official-quality models rather than downgraded substitutes, which can help control API spend without changing the expected model quality.
4. Protect logs, builds, and pull requests
Do not log authorization headers, environment dumps, full request configuration, or provider error details that may contain credentials. Log useful operational information instead, such as request IDs, latency, model names, and status codes. Review what your application, reverse proxy, analytics tools, and error tracker capture.
- Enable secret scanning in your repository host and CI pipeline.
- Review changes before merging, especially configuration files and test fixtures.
- Use CI secret storage rather than committing credentials or printing them during builds.
- Test that error responses and debug logging do not expose request headers.
5. Rotate keys and respond quickly to a leak
Rotate keys on a schedule appropriate to your risk, when staff or systems change, and immediately after suspected exposure. If a key leaks, revoke it in the provider dashboard first; deleting the visible text from a commit does not invalidate copies in Git history, forks, logs, or caches. Then create a replacement, update the secret manager, redeploy, and check usage and billing for unexpected activity. Remove the exposed value from history where practical, but treat revocation as the essential step.
Before launch, confirm that the key is absent from the frontend bundle and repository, production access is restricted, logs are clean, and you know how to revoke and replace it. If you want an affordable route to Claude and GPT models with pay-as-you-go billing, you can sign up for 59API and test it with a server-side integration first; its referral rebate can also help lower costs.