{"slug": "openai-or-anthropic-api-key-exposed-in-the-browser", "title": "OpenAI or Anthropic API key exposed in the browser", "summary": "A developer at Axonscape has flagged a common security flaw in AI-built apps: OpenAI or Anthropic API keys exposed in browser code when clients are created with dangerouslyAllowBrowser or keys are read from VITE_ or NEXT_PUBLIC_ prefixed environment variables, making them readable by any visitor and spendable on the owner's account. The writeup recommends moving all AI calls to a server-side API route that reads the key from a server-only variable, adding a per-user rate limit, and revoking the exposed key. Axonscape's Launchpad offers a free launch check that scans a public GitHub repo or code zip for this and other pre-launch issues without retaining data.", "body_md": "An AI client created with dangerouslyAllowBrowser, or a key behind a VITE_ or NEXT_PUBLIC_ prefix, puts your API key in the page, where anyone can copy it and spend on your account.\n\nThe OpenAI or Anthropic client is created in a component, with `dangerouslyAllowBrowser: true`, or the key is read from `VITE_OPENAI_API_KEY` or `NEXT_PUBLIC_…`.\n\nAnything the browser runs, every visitor can read. A public prefix means the value is bundled into the JavaScript everyone downloads.\n\nPaste this into Lovable, Bolt, v0, Replit or Cursor:\n\nThe AI API key is exposed in the browser. Move every AI call to a server-side API route that reads the key from a server-only environment variable (no VITE_ or NEXT_PUBLIC_ prefix), have the browser call that route, and add a per-user rate limit. Then tell me to revoke the old key.\n\nThe full page, with the request ready to copy, is at [launchpad.axonscape.com/fix/ai-api-key-exposed-in-browser](https://launchpad.axonscape.com/fix/ai-api-key-exposed-in-browser). I work on Launchpad by Axonscape, which runs a [free launch check](https://launchpad.axonscape.com/check) for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.", "url": "https://wpnews.pro/news/openai-or-anthropic-api-key-exposed-in-the-browser", "canonical_source": "https://dev.to/axonscape/openai-or-anthropic-api-key-exposed-in-the-browser-5940", "published_at": "2026-11-05 09:40:53+00:00", "updated_at": "2026-11-05 09:49:26.169459+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-products"], "entities": ["OpenAI", "Anthropic", "Axonscape", "Launchpad", "Lovable", "Bolt", "v0", "Cursor"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openai-or-anthropic-api-key-exposed-in-the-browser", "markdown": "https://wpnews.pro/news/openai-or-anthropic-api-key-exposed-in-the-browser.md", "text": "https://wpnews.pro/news/openai-or-anthropic-api-key-exposed-in-the-browser.txt", "jsonld": "https://wpnews.pro/news/openai-or-anthropic-api-key-exposed-in-the-browser.jsonld"}}