Guides / Exposed API keys: how to check

Exposed API keys in AI-built apps: how to check

Updated November 3, 2026

When an AI tool wires up an API call, it sometimes puts the secret key right in the frontend code, because that's the quickest way to make the feature work. Once deployed, that key is downloadable by anyone who opens your site. Here's how to check and what to do.

Which keys are OK to be public?

Some keys are designed to be public: the Supabase anon key, Firebase web config, Stripe publishable keys (pk_live_), and browser-restricted Google Maps keys. They rely on other protections (RLS, security rules, domain restrictions).

Others must never reach the browser, including:

• OpenAI keys (start with sk-, often sk-proj-) and Anthropic keys (sk-ant-)
• Stripe secret and restricted keys (sk_live_, rk_live_)
• The Supabase service_role key
• AWS access keys (start with AKIA), GitHub tokens (ghp_, github_pat_), Slack bot tokens (xoxb-)
• Email provider keys (Resend, SendGrid, Mailgun) and database connection strings

How to check your live site

1. Open your deployed site (not localhost) in Chrome.
2. Open DevTools (F12) and press Ctrl+Shift+F (Cmd+Opt+F on Mac) to search across all loaded files.
3. Search for the prefixes above, and for words like secret, service_role, apiKey, Bearer.
4. Check the Network tab too: if your browser calls api.openai.com directly, the key is in that request.
5. Try loading /.env and /.git/config on your domain. Both should return a 404.
6. Look for .map files. Source maps can expose your original source, including comments and config.

Why it happens

• Framework prefixes: in Vite, VITE_* variables are bundled into client code; in Next.js, NEXT_PUBLIC_* variables are. Putting a secret in one of these makes it public.
• The AI calls a third-party API straight from a React component instead of from a server route.
• A key pasted into a prompt ends up hard-coded in a file.

If you find one

1. Rotate it first. Create a new key in the provider's dashboard and revoke the old one. Deleting it from the code doesn't help if it was already public, and it may still be in your git history.
2. Move the call server-side. Use an API route, serverless function or Supabase Edge Function, and read the key from an environment variable that isn't exposed to the client.
3. Check usage and billing on the provider for activity you don't recognize, and set spending limits where the provider offers them.
4. Redeploy and check again using the steps above.

A prompt you can give your AI tool: "Move every call that uses a secret API key into a server-side function. Read keys from environment variables that are not exposed to the browser. Make the frontend call our own endpoint instead."

More guides: Is my Lovable app secure? · Bolt.new app launch checklist · Supabase RLS checklist · Pre-launch checklist: Cursor, v0, Replit