Guide · Security
How to Secure Your OpenAI API Key
OpenAI keys are high-value targets. Here's how to keep them secure—backend only, rate limits, and quotas.
Provider keys belong in a secrets backend with rotation—not in clients or repos. Primary control: Secrets Management
One rule: the browser never sees `sk-`
An OpenAI secret unlocks metered spend with no provider-side hard cap by default. If it ships in a web or mobile client, scrapers treat it as public. APRF Secrets Management plus AI Security means: server-only key, quotas on the caller, alerts before the invoice.
A mobile build once used `EXPO_PUBLIC_OPENAI_KEY`. The secret landed in the IPA. After rotation, calls moved to a BFF with Cognito users and per-account token wallets.
Pattern that works
Client (no provider key) → your API (auth + rate + quota) → OPENAI_API_KEY from secrets storeNever `NEXT_PUBLIC_` / `EXPO_PUBLIC_` / Vite `VITE_` for secrets. Cap requests and tokens per user or API key (Redis works). Set OpenAI dashboard usage alerts at 50% / 80% / 100% of expected spend.
If it already leaked
Revoke in the dashboard first, then ship the proxy, then rotate siblings that shared the same pattern. Weekly glances at provider usage catch loops and scrapes that alerts miss.
Next: Secrets Management
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.
Related
Frequently asked questions
- Can I use my OpenAI key in the frontend?
- No. Any key in frontend code can be extracted. Use a backend proxy for all OpenAI calls. The frontend calls your API; your server calls OpenAI.
- How do I set up OpenAI billing alerts?
- In the OpenAI dashboard, go to Settings > Billing. Set up usage limits and email alerts. You can also use AWS or a third-party tool to monitor spend.
- What if my OpenAI key was leaked?
- Rotate the key immediately in the OpenAI dashboard. Revoke the old key and create a new one. Move all API calls to a backend proxy so the key is never exposed again.