An AI tool tells you to “add your API key,” but does not explain where. Pasting it into the first file that removes the error can expose it to every visitor. It can also leave the key in the saved history of past changes.
An API key is a private access code that lets software use another service, such as payments, email, maps, or AI. Private keys belong in your hosting platform's protected settings. Only the locked part of the app, which visitors cannot download, should use them.
Is every setting secret?
No. Sort each value by who is allowed to see it:
- Public setting: safe for any visitor, such as the public site address or a tracking number made for public websites.
- Private setting: payment keys, database passwords, and secret codes used to confirm messages from other services.
- Behavior setting: time limits, on-and-off feature switches, and the amount of error detail shown in testing or on the live app.
Some app tools copy any setting whose name starts with NEXT_PUBLIC_ into code sent to the browser. Read that prefix as “publish this.” Never use it for a private key.
Where should a private key live?
Use the hosting project's protected settings, often called environment variables. The source code keeps a label such as PAYMENTS_API_KEY; the platform supplies the real value when it creates the live app.
On your own computer, a settings file named .env can hold test values. Do not include that file in shared project history or in the files you publish. A safe example file may list the setting names with fake placeholders, but never the real keys.
Find the setting in JustDeploy
- Open the project that runs the app.
- Under Advanced, expand Environment Variables and select Add.
- In Name, enter the exact label the app expects. Put the private key in Value.
- Select Add, then find the live version under Deployments and choose Rebuild.
- Wait for the rebuilt version to become live. Test the action that needs the key without printing its value.
What should you ask your coding AI?
Be specific: “Keep this key private. Read it from the protected settings in my hosting project. The browser must ask my app to do the private work; it must never receive the key.”
Then inspect the changed files. Stop before publishing if the real value appears anywhere public. Check files sent to the browser, settings marked public, screenshots, and shared files.
Why must private work happen behind the app?
Browser code is sent to every visitor and can be inspected. A safe browser request contains no private provider key. The protected part of your app checks the signed-in customer, uses the key, and returns only the result the screen needs.
If a visitor can download the code that contains a value, that value is public—even if its name says “secret.”
Logs and error messages need the same care. Record the setting's name, the service's short result code, and a tracking number for the request. Never print the secret value.
Why did the new value not take effect?
A protected setting may be saved on the wrong project, have a misspelled name, or have changed after the current release was created. On JustDeploy, use Rebuild on the live deployment after adding, changing, or deleting a value. Merely saving the setting does not update the running app.
Ask the app to fail with a clear message such as PAYMENTS_API_KEY is not configured. That identifies the missing label without revealing the key.
What should you do if a key leaked?
- Create a replacement key in the service's dashboard.
- Update the protected project setting.
- Publish and wait for the new release to become live.
- Test the customer journey that uses the key.
- Turn off the old key and check the service's activity page for unknown use.
Do this even if you deleted the key from the latest file. Someone may already have copied it, and older project history may still contain it.
What belongs in a release check?
| Check | Question |
|---|---|
| Audience | Is this value safe for any visitor to inspect? |
| Owner | Who can replace it, and is that process written down? |
| Release | Was a new version published after the value changed? |
| Logs | Can a failure be diagnosed without printing the value? |
| Removal | Was an old key revoked rather than merely left unused? |
Protected settings do not make every use safe. They keep the value out of files sent to visitors. The project names what it needs, the platform supplies the value, and the locked part of the app controls when it is used.
What should you read next?
- How to Add Login Without Exposing Customer Data
- Why Your AI App Works in Preview but Breaks Online
- AI App Launch Checklist for Solo Founders
Use the JustDeploy credentials guide to create a key with only the access your app needs.