Skip to content
BuildThenTestedSee packages
CriticalAI features

LLM API key exposed to the client

Anyone who views the page source can copy the key and run their own workloads on your account until the bill or the provider stops them. Calls to a language model inside the app, and what they can trigger. Check it yourself with the steps below; our test adds what a script and a second account can find.

What it looks like

// src/lib/ai.ts  (runs in the browser)
const client = new OpenAI({
  apiKey: import.meta.env.VITE_OPENAI_API_KEY,
  dangerouslyAllowBrowser: true,
});
A model provider client created in front-end code, with the secret API key (the credential that bills your account) compiled into the JavaScript bundle the browser downloads.

What happens

Anyone who views the page source can copy the key and run their own workloads on your account until the bill or the provider stops them.

Where it shows up

Descriptive, not a verdict: builders and stacks whose defaults make this reachable, or that a public incident names. Each hub states the tool's own security features.

Seen in public

Two days after announcing a SaaS built with Cursor and no hand-written code, its founder reported subscription bypasses, maxed-out API keys and unwanted database writes; he shut the app down three days later.

  • 2025-03-15 Launch announcement
  • 2025-03-17 Report of subscription bypass and API key abuse
  • 2025-03-20 Shutdown announcement

Mar 2025 · Leo (Enrichlead founder) · all sources

Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data.

  • more than 5,600 Apps analysed
  • more than 2,000 Vulnerabilities found
  • 400+ Exposed secrets
  • 175 Exposed PII instances

Oct 2025 · Escape · all sources

Check it yourself

Uses your builder's dashboard and your browser. No tools to install.

  1. Open your live app, press F12, select the Network tab, and use the AI feature once.
  2. Look for a request going directly from the browser to api.openai.com, api.anthropic.com or another provider domain. Click it and read the Headers tab for an Authorization or x-api-key header.
  3. Open the Sources tab (or view the page source) and search the JavaScript for sk-, sk-ant-, VITE_, NEXT_PUBLIC_ or EXPO_PUBLIC_ next to a provider name.
  4. Bad result: the browser talks to the provider directly with a key in the header, or a key string appears anywhere in the downloaded JavaScript. Rotate that key in the provider console the same day.

What we check

We download every JavaScript bundle of the deployed app, scan it for provider key formats, and test each hit against the provider to confirm whether it is live and what it can spend.

Fix direction

Move the call to a server route or edge function that reads the key from a server-only environment variable, and have the browser call your route instead. OpenAI's API reference states that keys must not be exposed in client-side code such as browsers or apps; rotate any key that has already shipped.

Mechanism documented in: API Overview: Authentication (verified 2026-09-21).

Covered by

Ready-to-charge check ($390, 48 hours) and Full audit ($1,900, 5 business days)

Both include a re-check after your fixes.

Compare packages

Related patterns

  • Third-party API key in the JavaScript bundleSecrets and keys

    Anyone who views the page source can take the key and run up charges, send messages or pull data on your account until the key is revoked.

    High
  • NEXT_PUBLIC_ prefix on a secretSecrets and keys

    The build writes the secret's value into public JavaScript, so anyone who loads the site can read it, and a redeploy with the same variable name republishes it.

    Critical
  • No spend cap on model callsAI features

    A script can hit the route in a loop overnight and the bill lands on your card, or the provider pauses your account mid-day when its own cap trips and every user sees errors.

    High
  • Secrets in the mobile app bundleMobile

    Anyone who downloads the app from the store can unzip it and read the key, then run up your bill or read your database as an administrator.

    Critical

Questions

openai api key exposed frontend

OpenAI's API reference says not to expose the key in any client-side code such as browsers or apps. Front-end frameworks compile variables prefixed VITE_, NEXT_PUBLIC_ or EXPO_PUBLIC_ into the shipped JavaScript, so a provider key under one of those names is public. Search the deployed bundle for sk- to confirm, then rotate.

api key in frontend runaway bill

Once a key is public, others can call the provider with it at your expense. The founder of one SaaS built with Cursor reported exposed API keys and maxed-out usage days after launch (Leo (Enrichlead founder), 2025). Rotate the key, move the call behind a server route, and set a provider-side spend limit so a repeat has a ceiling.

is it safe to call openai from the browser

Not with your account's secret key. The browser can call your own server route, which holds the key and adds login checks and quotas before forwarding to the provider. SDK flags named dangerouslyAllowBrowser exist for demos, and the name is the warning.

Back to the catalogue, or run the self-check for your stack.