Last reviewed 31 October 2026
Who this step is for
Skip this guide if you have never created an account with an AI service, a website platform, a payment processor, or any developer tool. But if you use AI tools for work, built a site, take payments online, or ever followed a tutorial that had you “generate a key” — this step is yours, and it's the one most people have never heard of.
What an API key actually is
An API key is a password — not for you, but for software acting as you. When a tool connects to a service on your account, it presents the key instead of a login. Whoever holds the key can use the service and bill your account, usually without triggering the login alerts you'd get from a human signing in.
Three properties make keys dangerous in a way normal passwords aren't:
- They're made to be copied. Keys get pasted into settings files, code, documents, and chats as a normal part of setting things up.
- They're forgotten. The key from a project you abandoned two years ago is usually still active.
- They bill silently. A leaked AI or cloud key can run up hundreds or thousands in usage before a statement arrives.
The rule that matters most
Any key that was ever pasted into a chat, a document, an email, or a code repository, treat as leaked. Not “probably fine” — leaked. Revoke it and issue a fresh one if you still need it. This includes keys pasted into AI chats while asking for help setting something up, which is the single most common way keys escape.
And the mirror-image rule for working with anyone — a person or an AI assistant: share key names and status, never the key itself. Nobody helping you needs to see the value.
The cleanup, service by service
Work through every service where you might have keys — AI providers (OpenAI, Anthropic, and similar), payment processors (Stripe), website and app platforms, email services. The screens differ; the moves are the same:
- Find the key list. Look for “API keys,” “Developers,” or “Integrations” in settings.
- Delete every key you don't actively use. Test projects, old tutorials, tools you stopped paying for — gone. Deleting a key you turn out to need costs two minutes to re-issue. Keeping one you forgot costs whatever a stranger spends on it.
- Check where surviving keys live. A key stored in a project file on your computer is normal; the question is whether that file ever left your machine. If the project is shared or stored in a code repository, check that the file holding real keys is excluded from sharing (in code projects, that's the
.gitignorefile — the key file should be listed there, and only a placeholder example should be shared). - Cap the spend. Most AI and cloud services let you set an organization-level monthly spending limit or alert. Set it near your real usage. A cap converts a leaked key from an unbounded bill into a bounded one.
What “done” looks like
When we ran this step as part of a real lockdown, the whole inventory came down to one active key, in one project, with a two-minute verification that it had never been included in the shared version of that project. That's the normal outcome — most people have far fewer keys than they fear. The step is short precisely because the list is short. The risk was never the number of keys; it's that nobody had ever looked.
The storm connection
This is the “check the garage door” step of digital readiness: not the most likely entry point, just the one nobody remembers leaving open. Ten quiet minutes now beats explaining a four-figure usage bill during the week you're also filing an insurance claim.
Sources: Provider documentation for the services you use (key management and spending-limit settings) · Federal Trade Commission — consumer.ftc.gov