Does minifying my code hide the API key?

No. Minifying shortens variable names; the key stays a plain string anyone can search for.

The key in the bundle

Q: Is my API key exposed in my frontend code?

If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.

Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.

This answers: Is my API key exposed in my frontend code? No coding needed. 3 quick decisions.

Keys and secrets
How a request travels

Step 1 of 3

You open your 's JavaScript in the browser and search for 'sk-'. What did you find?

_next/static/chunks/app/chat/page-3f9a.js

const client = new OpenAI({  apiKey: "sk-proj-8Hq…W2x",  dangerouslyAllowBrowser: true,});

Is my API key exposed in my frontend code?

If the key is in a variable with a such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your and anyone can copy it. Revoke the key, create a new one, and call the paid from your server only.

Trail of the bug

Breaks at Browser: Secret key shipped to every browser

How it works

Where your keys end upName it NEXT_PUBLIC_

Your server: private

OPENAI_KEY (secret)

Every visitor's browser: public

Publishable key (meant to be here)

The secret key stays on your server, where visitors can't see it. Only the publishable key, made for browsers, goes out.

Why AI tools write this bug

When a key is undefined in browser code, the quickest fix an AI suggests is adding a . The error disappears and the secret becomes public.

How to fix it

Search your built JavaScript for the key's prefix, such as sk-.
Revoke the leaked key immediately; renaming it is not enough.
Move the call into a server route or server action.
Keep secrets in variables without a .

Check your own app

Paste this into Lovable, Cursor or Claude Code:

Search this project for every environment variable with a public prefix (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_, PUBLIC_) and every API key or token string in the code. For each, tell me whether it is safe to be public. Flag any secret key that ends up in browser code.

Common questions

Does minifying my code hide the API key?: No. Minifying shortens variable names; the key stays a plain string anyone can search for.