// API keys

Which API keys are safe to expose?

Some keys are meant to sit in your front end. Others hand over your account. Each guide shows what the key looks like, whether it is safe to expose, and what to do if it leaked.

• Supabase keys: which ones are safe to exposeThe anon key and the newer sb_publishable_ key are designed to sit in your front end, and they are only safe when row level security is on for every table. The service_role key and sb_secret_ keys bypass RLS completely, so they must stay on a server.
• Stripe keys: which ones are safe to exposeOnly the publishable key (pk_live_ or pk_test_) belongs in your front end. Secret keys (sk_live_) and restricted keys (rk_live_) act as your Stripe account over the API, so they stay on your server, and a leaked one should be rotated straight away.
• Is your Firebase API key safe to expose?Yes. The apiKey in your Firebase web config (it starts with AIza) identifies your project and is meant to ship in your front end. Your data is protected by Security Rules and App Check, while service account keys for the Admin SDK are real secrets that must never reach a browser.
• Your OpenAI key leaked. Here's what to doNo OpenAI API key is safe to expose. Every key, whether it starts with sk-proj- or the older sk-, lets whoever holds it make requests billed to your account, so it belongs on a server. If one leaked, revoke it on the API keys page, create a new one, and check your usage.
• Your Anthropic key leaked. Here's what to doAn Anthropic API key (it starts with sk-ant-) is never safe in front-end code: anyone who reads it can call Claude on your bill. If it leaked, delete it on the API keys page of the Anthropic developer console, create a new one, and review usage and cost for that workspace.
• Your AWS access key is exposedAn AWS access key is never safe to expose. The access key ID (AKIA...) plus its secret access key let anyone act as that IAM user, so deactivate the key in IAM right away, check CloudTrail for what it did, and replace it with a role or a tightly scoped key kept on the server.
• Your GitHub token leakedA GitHub token is never safe to expose: it acts as you, with whatever scopes or repository access it was given. Revoke it under Settings, Developer settings, Personal access tokens, check your security log and repos for changes, and replace it with a fine-grained token or a GitHub App that expires.
• Lock down your Google Maps API keyA Google Maps key (it starts with AIza) is meant to be visible in your front end, but it's only safe with an HTTP referrer restriction for your domains and an API restriction for the Maps APIs you use. Without them, anyone can copy it and run up usage on your billing account.