What changes.
A secret API key is a credential that can authorize software to use a service. Depending on its permissions, that access may include private records, paid requests, or changes to another system.
Private service keys belong in the backend’s secret configuration. A value embedded in public browser JavaScript can be read by a visitor. An environment variable is not automatically private if the build exposes it to the browser.
Some services also provide public or publishable keys designed for client use. Follow that provider’s documentation rather than assuming every key works the same way. Keep account ownership and access recovery clear for the people maintaining the system.
A key grants access. Treat it as part of the system, not a setup detail.
A practical example.
A fictional website calls its own backend endpoint. The backend reads a private service key from its environment and returns only the result the visitor needs. The key does not appear in page source or browser responses.
- Browser request
- Private backend
- Provider service
Put it in place.
Start with the smallest version you can inspect from beginning to end. Agree the process before connecting live business data.
- 01
Identify whether the provider’s key is secret or intended for public use.
- 02
Create only the access the workflow needs.
- 03
Store secret values in the backend’s configuration.
- 04
Keep development and production access distinct where possible.
- 05
Configure available usage controls and monitoring.
- 06
Document account ownership and the revocation process.
- 07
If a secret is exposed, revoke it and review affected usage.
Check the handoff.
- Each key has a documented owner and purpose.
- Permissions are limited to the required work.
- Development and production access are separated where supported.
- Secrets are excluded from source files, screenshots, and logs.
- The team knows how to revoke an exposed key and inspect its use.
What to avoid.
- Putting secret keys in browser JavaScript.
- Sharing screenshots of secret values.
- Using one key for every project forever.
- No spending limits.
- No logs for failed requests.
Further reading.
Official documentation for the concepts and tools mentioned here. Follow the provider’s current instructions when implementing a connection.