Services give you keys so they know who is calling. A publishable key, such as a maps or Supabase anon key, is built to live in the browser and is restricted in what it can do. A secret key, such as one for a payment provider or an AI model, grants real power and money, and must stay on a server.
The frequent mistake is putting a secret key in frontend code because the AI tool wired the call directly from the page. Anything shipped to the browser can be copied by any visitor, then used to run up charges or read data. Keys also leak through public repositories and screenshots.
Call the third-party service from your own backend, keep the key in a server environment variable, and restrict each key by scope, allowed domain or spending limit where the provider allows it. If a key is exposed, revoke and replace it immediately. OWASP also warns that keys alone should not guard high-value resources.