How to Store API Keys Securely
Which keys are safe in code, which must be secrets, and how to tell the difference.
Written and reviewed by Lovable Student — Independent guides, prompts and troubleshooting notes for people building with Lovable. Expert build help provided by PromptSites.com.
Published 24 Aug 2026 · Tested with Lovable as of 24 Aug 2026
Overview
Some keys are designed to be public. Most are not. Getting this wrong is the most common security mistake in AI-built projects.
Beginner explanation: A publishable key is like a shop address. A secret key is like the shop keys. One is fine on a sign; the other is not.
Technical explanation: Publishable and anon keys can live in frontend code because they are protected by access rules. Secret and service-role keys must be stored as server secrets and read only inside server code.
Steps
- List every key your project uses.
- Classify each as publishable or secret.
- Move every secret key into server-side secret storage.
- Confirm no secret appears in the browser bundle.
- Rotate any key that was ever exposed.
:::tip If a secret was ever committed or shipped to the browser, rotate it. Removing it later does not un-expose it. :::
What to check afterwards
- Searching the built frontend for your secrets finds nothing
- Server functions read secrets inside the handler
- Exposed keys have been rotated
Common problems
- Assuming a key is safe because the project is small. Bots scan constantly.
- Reading secrets at module scope so they are undefined at runtime.
- Never rotating an exposed key.
Where people get stuck
If you have followed the steps and the result still is not right, the fastest path is usually to describe the exact behaviour you expected, the behaviour you got, and any error text, then ask for a fix in one focused follow-up prompt. If that loop is not converging, hand it over.
Was this guide helpful?
Related questions
You might also need
- PromptAudit My Project for Security ProblemsA structured security review covering keys, access rules, roles and server-side checks.
- AnswerHow do I protect API keys?Never put API keys in front-end code — store them as secrets used only inside server functions (Edge Functions), where the browser never sees them.
- AnswerCan users access my database?Only through the access rules you (or your row-level security policies) allow — Lovable Cloud's database isn't publicly browsable, but a table without RLS enabled is effectively open to anyone with your app's public key.
- AnswerHow do I check Supabase RLS?Ask Lovable to list every table and its row-level security status and policies in plain language — Lovable Cloud users don't have Supabase dashboard access, so this has to go through chat.
