The key inside the app
Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.
This answers: Can people see API keys in my Expo app? No coding needed. 3 quick decisions.
- Keys and secrets
- Costs and abuse
Step 1 of 3
Your AI set the key up like this. Who can read it?
EXPO_PUBLIC_SUPABASE_URL=https://abc.supabase.coEXPO_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOi...EXPO_PUBLIC_OPENAI_KEY=sk-proj-9f3a...Can people see API keys in my Expo app?
Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the are fine there. for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.
Breaks at Phone app: Secret key shipped inside the app
Why AI tools write this bug
AI tools often call OpenAI straight from the app to make a feature work quickly, and put the key in EXPO_PUBLIC_ because that's the only kind of variable the app can read.
How to fix it
- Delete the leaked key and create a new one.
- Move the call into a server function that holds the key.
- Check the user is signed in and limit usage per user there.
- Keep only public keys in EXPO_PUBLIC_ variables.
Check your own app
Paste this into Lovable, Cursor or Claude Code:
Without changing anything, list every environment variable this mobile app reads, and mark which ones are built into the app (EXPO_PUBLIC_ or similar). For each built-in one, tell me whether it is meant to be public (like a Supabase anon key) or a real secret, and which outside services the app calls directly from the phone.
Common questions
- Is the Supabase anon key safe in my app?
- Yes, it is designed to be public. Your Row Level Security rules are what protect the data, so they must be turned on for every table.