← Voltar aos guias

Stop API Key Leaks: A Practical Secure Setup

Securing your API keys starts with one rule

API keys are bearer credentials: if someone gets one, they can spend your quota, call your models, and sometimes leave you with a surprise bill. The most common leaks do not come from advanced attacks. They happen when developers paste secrets into frontend code, commit them to Git, print them in logs, or share them in screenshots and chat tools. The fix is simple in principle, but it has to be applied consistently.

The safest pattern is to keep keys server-side, load them from environment variables, and route all model calls through your backend. If you are working with Claude or GPT models, a relay like 59API can make that setup cheaper and cleaner: it is pay-as-you-go, compatible with Claude Code, Codex, and any OpenAI SDK, and it uses native official-quality models without forcing a downgrade. Its base URL is https://api.59api.com.

1. Keep secrets out of source control

Start by moving your key into a local environment file that never reaches Git. Your app should read the value at runtime, not from hardcoded strings.

.env

API_KEY_59API=your_real_key_here

.gitignore

.env

.env.*

Do not add API keys to JavaScript bundles, React components, mobile apps, or public examples. A key in client-side code is already leaked, even if you have not published the repository.

2. Load keys from the runtime, not the repo

Here is a simple Python example using the OpenAI SDK-compatible style that 59API supports. The important part is that the key comes from the environment.

Python

from openai import OpenAI

import os

client = OpenAI(api_key=os.environ['API_KEY_59API'], base_url='https://api.59api.com')

response = client.responses.create(model='your-model-name', input='Say hello safely')

In Node.js, keep the same principle:

import OpenAI from 'openai'

const client = new OpenAI({ apiKey: process.env.API_KEY_59API, baseURL: 'https://api.59api.com' })

Never substitute this with a hardcoded string like sk-... in a file. That is the most common leak pattern in real projects.

3. Put a backend between your users and the key

If your product has a browser UI, the browser should call your own backend, and your backend should call the API provider. This prevents users from opening DevTools and copying the secret from a network request.

Safe request flow: frontend → your backend → 59API → model

Unsafe request flow: frontend → 59API with embedded key in client code

A minimal server-side proxy can look like this:

const response = await fetch('https://api.59api.com/v1/chat/completions', {

method: 'POST',

headers: { Authorization: `Bearer ${process.env.API_KEY_59API}` },

body: JSON.stringify({ model: 'your-model-name', input: 'Write a summary' })

})

This design is especially useful when you are switching between Claude and GPT models through one relay. Because 59API is compatible with Claude Code, Codex, and standard OpenAI SDK clients, you can centralize access control instead of juggling multiple keys across tools and repos.

4. Stop leaks in CI, logs, and pull requests

Secrets often leak outside the app itself. Build systems, debug logs, and pasted config files are frequent culprits. Add guardrails to every delivery step.

• Use CI secrets storage such as GitHub Actions Secrets or your CI provider’s secret manager, not plain YAML values.
• Mask secrets in logs and never print request headers, full environment dumps, or raw error objects that may include credentials.
• Scan commits automatically with tools like GitHub secret scanning, Gitleaks, or TruffleHog before merge.
• Review pull requests for config files that include .env samples, sample tokens, or pasted screenshots with visible keys.

One practical habit: treat every new API key as temporary until it has passed code review, deployment, and a quick secret scan.

5. Rotate fast if a key is exposed

If you suspect a leak, do not wait. Revoke the key, issue a replacement, update the environment variable, and check usage logs for unusual activity. If the key was committed, assume it is public forever, even if you deleted the file later.

Use separate keys per project or environment whenever possible. Production, staging, and local development should not share the same credential. That way, if a dev key leaks, the blast radius stays small.

Why 59API helps you stay secure and save money

59API is a good fit when you want to reduce secret sprawl without paying premium prices. Because it offers cheap pay-as-you-go access to Claude and GPT models, you can test safely, keep one relay endpoint in your code, and avoid overprovisioning expensive direct accounts. The referral rebate is also a nice bonus if your team or community signs up through your link.

If you are building an AI app today, the best time to secure your keys is before the first commit. Set environment variables, keep the key off the client, scan your repo, and route model access through a backend or relay. If you want a low-cost way to do that with native-quality model access, sign up for 59API, point your SDK at https://api.59api.com, and keep your secrets where they belong.

Preços · Docs