API Key Security for AI Coding Tools
Keep credentials out of repositories, browser bundles, screenshots, and logs when setting up coding tools.
Keep keys out of project files
An API key authorizes requests against your account. Use your client's credential settings or a local environment variable instead of a tracked configuration file. If a project uses an environment file, confirm Git ignores it before adding credentials. Commit an example file with placeholder values only.
Keep web application secrets on the server
A key included in browser JavaScript is available to visitors even if the interface never displays it. Store the key in the server environment and make authenticated API calls from the server. Never use a public environment-variable prefix for a secret. Protect your application endpoint with authentication and appropriate usage controls too.
Redact support material
Remove authorization headers and key values before sharing terminal captures, configuration files, or error reports. Logs can include request settings even when the main error looks harmless. Share a timestamp, endpoint path, status code, and redacted error instead of complete credentials. Check screenshots as carefully as text.
Treat an exposed key as compromised
If a key reaches a public repository or someone else's logs, replace or revoke it using the available account controls. Contact support if you cannot do this yourself. Update legitimate clients and review account activity. Deleting the visible text does not invalidate copies that already exist, including copies in Git history.
Debug without printing the secret
Check whether a credential is present rather than printing its value. Verify the endpoint and model separately, then send a small request. Keep production credentials out of demos and shared development environments. These habits reduce accidental exposure without requiring a complicated setup.