API key management is the practice of securely generating, storing, distributing, rotating, and revoking the access credentials (API keys) used to authenticate requests to AI services and LLM APIs. Poor key management is one of the most common causes of security breaches, unauthorized usage, and unexpected costs in AI applications.

Best Practices

• Never Hardcode Keys: API keys should never appear in source code, config files checked into version control, or client-side code. Use environment variables or secrets managers instead.
• Use Secrets Managers: Store keys in dedicated services like AWS Secrets Manager, Azure Key Vault, Google Secret Manager, or HashiCorp Vault.
• Rotate Regularly: Change keys on a regular schedule (e.g., every 90 days) and immediately if a compromise is suspected.
• Least Privilege: Create separate keys for different services, environments (dev/staging/prod), and team members with minimal required permissions.
• Monitor Usage: Track API key usage patterns — sudden spikes may indicate compromised keys or unauthorized use.

Common Mistakes

• Committing to Git: Keys accidentally pushed to GitHub or other public repositories are immediately discovered by automated scrapers. Even deleting the commit doesn't help — it remains in git history.
• Client-Side Exposure: Embedding keys in frontend JavaScript, mobile apps, or browser extensions exposes them to anyone inspecting the code.
• Sharing Keys: Teams sharing a single API key have no visibility into who made which requests and no ability to revoke individual access.
• No Expiration: Keys that never expire accumulate over time, increasing the attack surface.

Key Lifecycle

• Generation → Secure Storage → Distribution → Monitoring → Rotation → Revocation

Tools for Detection

• git-secrets: Prevents committing secrets to git repositories.
• truffleHog: Scans git history for exposed secrets.
• GitHub Secret Scanning: Automatically detects exposed API keys in public repositories and alerts the key provider.

Proper API key management is a foundational security practice — a single exposed OpenAI or cloud API key can result in thousands of dollars in unauthorized usage within hours.