Secure your API keys in any stack

OpenAI

Node.js / TypeScript

Next.js Route Handlers and Server Actions run on Node.js, but a single misconfigured NEXT_PUBLIC_ prefix or a leaked .env.local file exposes your sk-proj- key to the world. With KeyVault Edge the real key never sits in your app, and the token only works from your allowed hosts.

OpenAI

Python / FastAPI

Python apps frequently log environment variables during startup, ship .env files in Docker images, or expose keys through framework debug pages. With KeyVault Edge, your real sk-proj- key never appears in your Python process at all.

OpenAI

Node.js / Express

Node.js apps using dotenv often commit .env files or expose process.env through verbose error pages. A stolen sk-proj- key costs you money immediately. KeyVault Edge tokens are only honoured for requests from your allowed hosts.

OpenAI

React / Next.js App Router

Calling the OpenAI API directly from React browser code ships your sk-proj- key in the JavaScript file every visitor downloads, and scanners look for exactly that. A server-side route keeps the key out of the bundle; KeyVault Edge keeps it out of your server too and puts limits on the token that replaces it.

OpenAI

Node.js / TypeScript

OpenAI Realtime requires a client-side WebSocket or WebRTC connection — there is no way to make that connection without an API credential in the browser. Hardcoding your sk-proj- key in JavaScript means any visitor can extract it and drain your account. Ephemeral session tokens expire in 60 seconds, are scoped to a single session, and cannot be reused.

Anthropic

Node.js / TypeScript

Anthropic API keys (sk-ant-api03-...) grant unlimited Claude access and can rack up thousands in charges overnight. Leaked .env.local files in Next.js are a common vector — KeyVault Edge makes any leaked key non-functional outside your declared hosts.

Anthropic

Python / FastAPI

Python's anthropic SDK reads ANTHROPIC_API_KEY from the environment at import time. A misconfigured Docker COPY or a verbose exception traceback can expose it. KVE tokens are refused when the request's Origin isn't on the token's allowed hosts.

Anthropic

Node.js / Express

In Node.js Express apps, process.env is accessible to any code running in the same process. A compromised dependency or a verbose /debug route can leak your Anthropic key. KeyVault Edge tokens fail validation outside your bound hosts.

Stripe

Node.js / TypeScript

A leaked Stripe sk_live_ key lets attackers issue refunds to their own cards, list all your customer payment methods, and create fraudulent charges. KeyVault Edge binds the key to your domain so it's inoperable if stolen.

Stripe

Node.js / Express

Express apps are frequently misconfigured to expose process.env through /debug or /health routes. A leaked Stripe sk_live_ key gives attackers full access to your payment data. KeyVault Edge host-binding makes the token inoperable anywhere else.

Stripe

Python / FastAPI

Python Stripe integrations often include the key in Django settings or Flask config dictionaries that get printed during exceptions. A leaked sk_live_ key allows attackers to drain your Stripe balance. KVE tokens fail outside your allowed hosts.

Stripe

React / Next.js App Router

Calling Stripe's API directly from React client code exposes your sk_live_ key in the browser — anyone with DevTools can extract it and issue charges or refunds on your account. The publishable key (pk_live_) belongs in the browser; the secret key never does.

GitHub

GitHub Actions / CI

GitHub PATs used in Actions workflows can be extracted from workflow logs, step outputs, or compromised third-party Actions. A leaked ghp_ token with repo scope gives full write access. With KVE, the PAT itself never sits in GitHub, and the token can be scoped to the release endpoint and revoked independently.

AWS

Node.js / AWS SDK v3

AWS long-term access keys committed to git or leaked in CI logs give attackers full access to your cloud infrastructure. A single AKIA key can spin up EC2 instances and rack up thousands in charges within hours. IAM roles remove long-term keys entirely.

AWS

Python / boto3

boto3 reads credentials from environment variables, ~/.aws/credentials, or EC2 instance metadata. A leaked AKIA key lets attackers assume IAM roles, read S3 buckets, and run Lambda functions. IAM roles remove long-term keys entirely.

Twilio

Node.js / Express

A leaked Twilio Auth Token lets attackers send SMS messages, make phone calls, and enumerate your phone number inventory — all billed to your account. KVE host-binding makes the token inoperable from any host other than your declared server.

Twilio

Python / FastAPI

Python Twilio integrations often store the Auth Token in Django settings or Flask config. An exception traceback can expose it. A compromised Twilio Auth Token can send SMS globally at your expense. With KVE, the real key never sits in your app's config.

SendGrid

Node.js / Express

A leaked SendGrid API key with Mail Send permission lets attackers send phishing emails from your verified domain, damaging your sender reputation permanently. KVE tokens are bound to your server — stolen tokens cannot send email from other hosts.

SendGrid

Python / FastAPI

SendGrid keys in Python apps are often stored in Django settings.py or Flask app.config, both of which appear in debug tracebacks. A leaked key with Mail Send permission lets attackers send phishing emails from your verified domain. KVE tokens are host-bound.

Google AI

Python / FastAPI

Gemini keys found in repos, logs and bundles produced public bills of thousands of dollars in 2026. Google now rejects unrestricted keys and offers project-level spend caps, but those limits cover a whole project, not one app. With KVE the real key never sits in your app, and each token carries its own limits.

Google AI

Node.js / TypeScript

Gemini keys in Next.js apps are often exposed through NEXT_PUBLIC_ variables, which put them in front of every visitor. KVE tokens stay server-side, requests from hosts outside the token's allowlist are refused and logged, and a leaked token can be revoked without touching your Google key.