API keys belong on the server, outside public files and source control. Browser code should call a limited same-origin endpoint with server validation. Combine session protection, per-user and shared spending limits, bounded input and output, and concurrency controls. Origin checks alone cannot stop scripted clients; hard shared quotas limit financial exposure.
What to check
- Rotate exposed keys and separate environments.
- Enforce limits on the server, not only in the browser.
- Monitor failures without logging tokens or private chat text.