Safety
API key
An API key authenticates your requests to a provider and, in most cases, is the only thing standing between an attacker and your billing account.
Keys belong in environment variables or a secret manager, never in source control, never in client-side code, and never in a prompt.
The most common leak is not a breach: it is an engineer pasting a config file or a stack trace into a chat window to ask what is wrong.
In practice
Give every agent and every environment its own key. Shared keys make the audit log useless, make revocation an outage for everyone, and remove the only cheap way to answer "what got expensive" — per-key spend attribution. Development keys with their own limits stop a runaway test from spending the production budget.
Common questions
Should each service have its own API key?
Yes. Shared keys make the audit log useless, make revocation an outage for everyone, and remove per-key spend attribution — which is the cheapest way to answer "what got expensive" later.
What do I do if a key leaks?
Revoke first, investigate second. Then check spend since the leak, and check whether the key was in a prompt, a log or a client bundle — because if it was in one, assume it is public.