Five Ways Your API Key Leaks (and How to Stop It)

Your API key is a credential with a balance attached. Anyone holding it can spend your points and quota, and you will not know until the bill or the balance tells you. The five leak paths below account for almost every real-world case.

1. The key in frontend JavaScript

This is the most common and the easiest to exploit. Everything sent to the browser can be read — "hiding" the key in a minified bundle hides nothing; one click in the Network tab is enough.

The fix is a thin proxy on your backend. The frontend calls your server; your server holds the key:

// your backend (Node/Express)
app.get('/api/proxy/wilayah/*', async (req, res) => {
  const path = req.params[0] + (req.url.includes('?') ? '?' + req.url.split('?')[1] : '');

  const upstream = await fetch(`https://v1.api.my.id/wilayah/${path}`, {
    headers: { Authorization: `Bearer ${process.env.APIMYID_KEY}` },  // key stays server-side
  });

  res.status(upstream.status).json(await upstream.json());
});

2. The key committed to Git

A key that ever entered Git history stays there even if you delete it in the next commit — and public repositories are scanned by bots within minutes. Keep keys in environment variables, and make sure secret files are in .gitignore before the first commit:

# .env  (and .env is in .gitignore)
APIMYID_KEY=myid_live_a1b2c3d4…

If your key was ever committed, assuming it is compromised is the correct assumption. Issue a new one and retire the old.

3. The key in a mobile app

APKs and IPAs can be unpacked. The strings inside can be read. This is fundamentally the same problem as the web frontend: your mobile app should call your backend, not our API directly.

4. The key captured in logs

A logger that records full request headers will write Authorization into your log files — and logs are often shipped to third-party services, retained for years, and readable by more people than you think. Redact sensitive headers before writing:

const safe = { ...req.headers };
delete safe.authorization;
delete safe['x-api-key'];
logger.info({ headers: safe }, 'incoming request');

5. The key shared over chat

A key pasted into Slack or WhatsApp lives forever in conversation history, gets indexed by search, and syncs to every teammate's phone. Send it through a secrets manager, not a chat client.

If a key has already leaked

The steps are simple and should happen immediately: issue a new key via POST /keys/register or the dashboard, roll it out across your deployments, then check GET /keys/me for usage you do not recognise.

Finally, one cheap and highly effective habit: use different keys for staging and production. If the staging key leaks, production is untouched — and you can retire it without drama.