One. Do not store keys in code. It sounds obvious, but API keys still leak every day through code pushed to GitHub, including private repositories accidentally made public. Use your cloud provider's secrets manager or a dedicated tool, and enable automatic secret scanning in your repositories, so a key that slips in is blocked before it gets out.
Two. Set a budget for each key. Most AI providers let you set a monthly spending limit or an alert when usage crosses a threshold. A key without a limit is a credit card without a credit line. Three. One key per use: do not use the same key in development, production and an internal tool. When something leaks, you will know exactly where from and can revoke one key without taking down the whole product.
Four. Limit permissions. Where the provider allows it, restrict each key to which models it can reach, from which IP addresses and for which actions. A key used only to classify text with a cheap model does not need access to the most expensive one. Five. Rotate keys regularly, for example every 90 days, and immediately after an employee with access leaves or after a platform you use reports a security incident.
Six. Monitor usage. A sudden jump in requests, use at unusual hours or requests to models you do not use are early signs of theft. Most providers show usage dashboards. Someone on the team should look at them, or set automatic alerts. Seven. Check your platforms. If you store keys in environment variables on a development or hosting platform, check whether it has reported a security incident in recent months. If so, rotate every key stored there, even if you did not get a personal notice.
And a word for managers: securing AI keys is not only a developer problem. At a startup where every expense counts, a bill of tens of thousands of dollars from a stolen key can hurt a whole quarter's budget. A few hours of work now are far cheaper than the conversation with your AI provider after it has already happened.
