What is an API key? Why beginners should never expose it

An API key is a service pass for your application

When you use OpenAI API or another AI service, you will often receive a long string called an API key. That key tells the service which account is making the request and whether that request is allowed.

You can think of it as a service pass. Your code uses the pass to call the AI service. The service uses the key to check permissions and track usage.

This matters because AI APIs often connect to billing or usage limits. If someone else gets your key, they may be able to send requests through your account.

Beginners often make this mistake when building their first AI demo. The tool works, so they publish the code. But if the key is inside the frontend or inside a public repository, the project is not safe.

Do not put an API key in frontend code

Frontend code runs in the user browser. If you put a key there, the browser can receive it. A normal user may not look for it, but someone with basic technical knowledge can inspect bundled files or network requests.

The safer pattern is simple: the frontend should send user input to your backend. The backend should call the AI service with the API key stored in environment variables. Then the backend returns only the final result to the frontend.

This extra step is not unnecessary complexity. It separates the visible part of your app from the private credentials that protect your account.

Do not commit an API key to GitHub

A second common mistake is committing an API key to GitHub. Even if you remove it later, the key may still exist in Git history. If a key is exposed, the safer response is usually to revoke it and create a new one.

For beginner projects, remember two habits. Do not commit `.env.local` files. Do not hardcode keys directly into normal source files.

This is a basic engineering habit. If you want your AI project to look credible, it is not enough that the demo works. It also needs to avoid exposing secrets.