API keys
For AG Digitalz builds, private keys belong behind the system. The client should get the benefit of AI without leaking credentials or giving random visitors access to paid model calls.
AG Digitalz field guide
API keys connect your website to AI safely.
An API key is a private software password. It lets backend code call an AI service, CRM, database, or automation tool without exposing secrets in public browser code.
Recommended setup
- OpenAI, Anthropic, Google, or another provider account
- Netlify environment variables
- Serverless function or backend route
- Key rotation process
- Usage limits and logs
- Separate development and production keys
What to avoid
- Putting keys in browser JavaScript.
- Sharing screenshots of secret values.
- Using one key for every project forever.
- No spending limits.
- No logs for failed requests.
Implementation
Build the workflow step by step.
Connect the smallest useful flow first, make ownership clear, then measure it before expanding.
Step 1
Create the key in the provider dashboard.
Step 2
Store it in Netlify environment variables, not HTML or frontend JavaScript.
Step 3
Create a serverless function that reads the key privately.
Step 4
Call the AI provider from that function.
Step 5
Return only the safe result to the browser.
Step 6
Set usage limits and monitor errors.
Step 7
Rotate the key if it is exposed or no longer needed.
Primary sources
Official documentation behind this guide.
Use these sources to verify capabilities, limits, and setup details before putting a workflow into production.
OpenAI API keys
Reference documentation used for this AG Digitalz field guide.
Open sourceOpenAI quickstart
Reference documentation used for this AG Digitalz field guide.
Open sourceNetlify environment variables
Reference documentation used for this AG Digitalz field guide.
Open source