Security

Keep project API keys private.

A project API key can send content into a project, so treat it like a backend secret.

Rules

Do

  • Store keys in backend environment variables.
  • Rotate keys that were exposed.
  • Create separate keys for development and production.
  • Delete unused keys from the project dashboard.

Rules

Do Not

  • Put project keys in frontend JavaScript.
  • Commit keys to Git.
  • Share one key across unrelated projects.
  • Paste production keys into public logs.