How to Protect Your OpenAI API Key From Leaks

Researchers who plant decoy keys in public repositories consistently see them found and tried within minutes, because automated bots continuously scrape public repositories and commit streams.

What happens next depends on your OpenAI usage limits. If you have no spending cap, an attacker can run as many completions as your account allows, and the bill is yours. OpenAI has a process for disputing fraudulent charges, but it is not instantaneous and outcomes are not guaranteed.

Beyond billing, a stolen key can be used to exfiltrate your conversation history, fine-tuning datasets, or Assistants data - depending on your API tier. The key is not just a payment credential; it is an identity credential for your OpenAI account.

The most common mistake is embedding an API key directly in source code. The correct pattern is to load the key from an environment variable at runtime. The key never touches your codebase.

const openai = new OpenAI({
  apiKey: "sk-proj-YOUR_REAL_KEYactual_key_here",
});

// .env.local (never committed)
OPENAI_API_KEY=sk-proj-YOUR_REAL_KEY

// your code
const openai = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY,
});

For production deployments, set environment variables through your hosting provider's secrets manager (Vercel environment variables, Railway secrets, Fly.io secrets) rather than in files. This ensures the key never touches the filesystem of the build container.

For local development, create a .env.local file and add it to .gitignore immediately. Verify the gitignore rule is working with git status before adding any real credentials.

A .gitignore entry for your .env files is necessary but not sufficient. A pre-commit hook that scans for credential patterns is a much stronger control - it catches mistakes before they leave your machine.

Install Gitleaks (open source, Apache 2.0) as a pre-commit hook:

# Install gitleaks
brew install gitleaks        # macOS
# OR: download binary from github.com/gitleaks/gitleaks/releases

# Run a one-time scan of your full repo history
gitleaks detect --source . --verbose

# Install as a pre-commit hook
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/sh
gitleaks protect --staged --verbose
EOF
chmod +x .git/hooks/pre-commit

GitHub also scans pushed commits via its built-in Secret Scanning feature (enabled by default on all public repositories). OpenAI is a partner provider - GitHub will alert you and notify OpenAI automatically when a valid key is detected. However, this fires after the push. A pre-commit hook fires before.

OpenAI supports creating multiple API keys per project. Use one key per application, per environment. Never share a production key with a development environment. This limits blast radius: a leaked dev key cannot be used to charge against production limits.

Set a rotation schedule. Monthly rotation for production keys is reasonable. If you detect any anomalous usage, rotate immediately. Rotation in OpenAI's dashboard is quick - the only cost is updating your deployment secrets, which should be scripted.

OpenAI's Projects feature (available to Plus and Team accounts) lets you create separate key namespaces with independent billing and usage limits. Use it to isolate your applications from each other. A compromise of one project's key does not affect others.

If your application calls the OpenAI API directly from a browser (client-side), your API key is exposed in the network tab of DevTools to any user who inspects it. There is no way to hide a key that lives in a browser - obfuscation does not count.

The correct architecture for browser apps is to add a server-side API route that holds the key and forwards requests to OpenAI:

import OpenAI from "openai";
import { NextRequest, NextResponse } from "next/server";

const openai = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY, // server-side only
});

export async function POST(req: NextRequest) {
  const { messages } = await req.json();
  const completion = await openai.chat.completions.create({
    model: "gpt-4o",
    messages,
  });
  return NextResponse.json(completion);
}

Your browser code calls /api/chat, not api.openai.com directly. The API key never leaves your server. Add rate limiting on the route to prevent abuse.

Even with a server-side proxy, the real API key still lives in your deployment environment - in Vercel secrets, Fly.io secrets, or an equivalent. If those secrets are compromised (through a supply chain attack, a misconfigured CI pipeline, or a leaked deployment log), the key is exposed.

A host-bound token proxy addresses this at a deeper level: your real OpenAI key is encrypted with AES-256-GCM inside a signed token that the edge proxy only honours for requests from the hosts you list. If the token leaks, requests from other origins are refused.

# The real key is gone from your environment
KVE_TOKEN=kvt_...your_token

# Requests go to https://proxy.keyvaultedge.com/v1/... with
#   X-KV-Token: $KVE_TOKEN
#   X-KV-Target: https://api.openai.com

The proxy verifies the token's signature, decrypts it in Worker memory, checks the request's origin against its allowed hosts, injects the real key into the Authorization header, and forwards the request to OpenAI. The plain-text key isn't stored in your deployment or your CI pipeline.

A leaked token is still worth rotating, and host-binding has limits: a server can forge Origin headers, so keep allowlists tight and set rate limits and cost caps.

Even with all the above controls, monitoring is your last line of defence. Set a hard monthly spend cap in the OpenAI dashboard (Settings → Billing → Usage limits). Set it to the maximum you would ever spend in a worst-case legitimate month, then set an email alert threshold at 80% of that.

Enable usage monitoring to receive email alerts when your usage crosses defined thresholds. If you receive an alert in the middle of the night, your key may be compromised - rotate it immediately and investigate.

If you use an edge proxy layer, you get per-request logs at the proxy level without needing to access OpenAI's dashboard. Look for: unusual request origin countries, request rates above your normal pattern, or model names you do not use.