Is your API key in your website's code?

One app with 60 users got a $3,900 OpenAI bill overnight. The key was in the JavaScript every visitor downloads. Find out in 20 seconds whether yours is.

  • OpenAI, Anthropic, Stripe, Supabase, AWS, GitHub, Resend and more
  • Keys are shown masked, never in full
  • Free, no sign-up

We read only what every visitor's browser downloads.

Why AI tools ship keys to the browser

Your website's code runs on every visitor's computer, so anything in it can be read: open the developer tools, search for sk-, done. Paid API keys belong on your server, where nobody can see them.

When a chat or AI feature needs a key and the browser cannot read it, AI tools tend to fix the error the quickest way: rename the variable to NEXT_PUBLIC_OPENAI_KEY or VITE_OPENAI_KEY, or add dangerouslyAllowBrowser: true. It works, and the key is now public.

How to fix an exposed key

  1. Revoke the key in the provider's dashboard and create a new one. Assume the old one is copied.
  2. Store the new key without a public prefix, so it stays on the server.
  3. Move the call into a server route or function, and have the page call that route instead.
  4. Add a usage limit or budget alert in the provider's dashboard, then scan again.

Questions

How does a secret key end up in my website?
Usually through a public prefix. Environment variables starting with NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_ are copied into the code every visitor downloads. AI tools add the prefix when the browser cannot read a key, because it makes the error go away.
I found a key. Is deleting it from the code enough?
No. Anyone may already have copied it, and old versions of your site can still serve it. Revoke the key in the provider's dashboard, create a new one, keep it on your server only, and call the paid API from a server route.
Is the Supabase anon or publishable key a problem?
No, it is meant to be public. It is only safe when every table has Row Level Security, so check your tables with the Supabase RLS checker. The service role or secret key must never be in your site.
Does the scanner see everything?
It reads the page and the script files it loads, up to 30 files. Code that loads later, on other pages or after sign-in, is not read. Ask your AI tool to search the whole project for keys as well.