Is your API key exposed in your AI-built app? How to check in 2 minutes

Guide · Ship-Ready Check · October 15, 2026

Ask an AI tool to "add ChatGPT to my app" or "connect Stripe", and the fastest way to make it work is to paste the secret key straight into the code. It works on the first try. It also means anyone visiting your site can copy the key and spend your money.

This guide shows you how to check your own app in about two minutes, and what to do if you find a key.

Why it's expensive

Bots scan public websites and code for keys constantly. Once one is found, it gets used fast.

In February 2026, a small team's stolen Google API key ran up about $82,000 in Gemini charges in 48 hours, on an account that normally spent around $180 a month. Google treated it as the customer's responsibility under its shared-responsibility model, as The Register reported.

There's a twist that catches even careful builders: researchers found that Google API keys created for public use, like Maps, can quietly gain access to Gemini once the Gemini API is enabled on the same project. A key that was safe to publish last year may not be safe today.

Which keys are safe to be public

Not every key is a secret. Here's the short version:

The 2-minute check

1. Look at what your website sends to visitors

Open your live app in Chrome, right-click, and choose Inspect. Go to the Sources tab, press Ctrl+Shift+F (or Cmd+Option+F on a Mac) to search all files, and search for each of these one at a time:

• sk- (OpenAI and Anthropic keys)
• sk_live (Stripe)
• service_role (Supabase)
• AIza (Google)

Anything you find there, every visitor can find too.

2. Check your variable names

Frameworks copy certain variables into the website automatically, based on their prefix: NEXT_PUBLIC_, VITE_, REACT_APP_ and EXPO_PUBLIC_. If a variable with one of those prefixes holds a secret, it's public, whatever its name says. NEXT_PUBLIC_OPENAI_SECRET is not a secret.

3. Check your repo

If your code is on GitHub, check that your .env file isn't in it and that .gitignore contains .env*. Then paste this into your coding agent:

Search this project for API keys or secrets written directly in code, including OpenAI, Anthropic, Stripe secret keys, Supabase service_role keys, Google keys, AWS keys and database URLs with passwords. List every file and line. Do not change anything yet.

Found one? Do this, in this order

1. Rotate the key first. Create a new key in the provider's dashboard and delete the old one. Deleting the key from your code is not enough, because a copy may already exist.
2. Move the call to your server. Your website should call your own backend route, and that route calls OpenAI or Stripe using a key stored in a server-only environment variable.
3. Put a limit on it. Set a spending cap or budget alert with every AI and cloud provider you use, and add a per-user rate limit to any endpoint that calls a paid API.
4. Check your bill for usage you don't recognize.