Skip to main content
  • Store API keys in a secret manager
  • Use separate keys for development and production
  • Rotate exposed or unused keys
  • Redact credentials and sensitive prompts from logs
  • Apply least privilege to tools called by models
Never send an API key to browser code or commit it to a repository.
Last modified on July 2, 2026