What is Secret key?

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Where Secret key goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Into the app stores · 4 minutes · Free
The key inside the app
Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.
Can people see API keys in my Expo app?
Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.
Walk it, free
Money and secrets · 4 minutes · Pro
The key you deleted
Your AI committed a file with your API key. You deleted it in the next commit and made the repo public a week later. The key is being used.
Deleted my API key from GitHub. Still exposed?
Yes, if it was ever committed. Git keeps every version of every file, so the key is still in the repository history, and bots scan public repositories quickly. Revoke the key and create a new one first, then clean the history, and turn on secret scanning with push protection.
Read the fix
Money and secrets · 4 minutes · Free
The key in the bundle
Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.
Is my API key exposed in my frontend code?
If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.
Walk it, free
Money and secrets · 4 minutes · Pro
The key you pasted into chat
To get Stripe working, you pasted your secret key into your app builder's chat. The project was public. Your builder has just announced a data exposure.
Is it safe to paste API keys into an AI chat?
No. Chats and prompts are stored, sometimes shared with the project, and can be exposed if the project or platform leaks. Put secrets only into your app's secret or environment settings. If you already pasted one, rotate it with the provider and make the project private.
Read the fix
Teams and sharing · 4 minutes · Pro
The export with everyone's data
A customer clicked 'Export orders to CSV'. The file had 40,000 rows. Their team has 300 orders. The rest belong to your other customers.
Does the Supabase service role bypass RLS?
Yes. The service role key bypasses every row level security policy by design, so any server code using it must check permissions itself. Leaks happen when that code also takes the team or user id from the URL or request body. Query with the signed-in user's client so RLS applies, and derive the team from their session.
Read the fix
Bills that explode · 4 minutes · Free
The open summarise button
Your app has a free 'summarise this PDF' button. Your AI bill says you made 2 million requests last night. You have 60 users.
How do I stop people abusing my app's AI endpoint?
Require sign-in, limit requests per user and per IP address, and cap the size of each request's input and output. Hiding the API key on your server is necessary but not enough: the endpoint that uses the key is public, and a script can call it millions of times.
Walk it, free

API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Authorization: Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.
Table, row, column: A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

All 62 terms in the glossary

Where Secret key goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Into the app stores · 4 minutes · Free

The key inside the app

Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.

Can people see API keys in my Expo app?

Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.

Walk it, free

Money and secrets · 4 minutes · Pro

The key you deleted

Your AI committed a file with your API key. You deleted it in the next commit and made the repo public a week later. The key is being used.

Deleted my API key from GitHub. Still exposed?

Yes, if it was ever committed. Git keeps every version of every file, so the key is still in the repository history, and bots scan public repositories quickly. Revoke the key and create a new one first, then clean the history, and turn on secret scanning with push protection.

Read the fix

Money and secrets · 4 minutes · Free

The key in the bundle

Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.

Is my API key exposed in my frontend code?

If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.

Walk it, free

Money and secrets · 4 minutes · Pro

The key you pasted into chat

To get Stripe working, you pasted your secret key into your app builder's chat. The project was public. Your builder has just announced a data exposure.

Is it safe to paste API keys into an AI chat?

No. Chats and prompts are stored, sometimes shared with the project, and can be exposed if the project or platform leaks. Put secrets only into your app's secret or environment settings. If you already pasted one, rotate it with the provider and make the project private.

Read the fix

Teams and sharing · 4 minutes · Pro

The export with everyone's data

A customer clicked 'Export orders to CSV'. The file had 40,000 rows. Their team has 300 orders. The rest belong to your other customers.

Does the Supabase service role bypass RLS?

Yes. The service role key bypasses every row level security policy by design, so any server code using it must check permissions itself. Leaks happen when that code also takes the team or user id from the URL or request body. Query with the signed-in user's client so RLS applies, and derive the team from their session.

Read the fix

Bills that explode · 4 minutes · Free

The open summarise button

Your app has a free 'summarise this PDF' button. Your AI bill says you made 2 million requests last night. You have 60 users.

How do I stop people abusing my app's AI endpoint?

Require sign-in, limit requests per user and per IP address, and cap the size of each request's input and output. Hiding the API key on your server is necessary but not enough: the endpoint that uses the key is public, and a script can call it millions of times.

Walk it, free

Related terms

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Authorization

Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.

Table, row, column

A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.