Your API keys are in the browser: which ones matter and the fix

The short answer

Everything your app sends to a visitor's browser, the visitor can read, including every key and setting baked into your JavaScript. That's how the web works, not a flaw someone has to break. So some…

The rule: if the browser has it, everyone has it

Fine in the browser: keys the vendor designs to be public, like Supabase's publishable key

Never in the browser: secret/service keys, AI-provider keys, payment secrets, DB passwords

The fix: a small server function holds the secret; the browser calls the function

If you think a key has already been used

Revoke it, check the vendor's usage or billing page for activity you don't recognise, and contact their support. If the key could reach other people's data, get help from a developer or a security…