Short answerNever put a key in public code or a web page, store it in a secrets manager or environment variable, set an expiry, rotate it, use separate projects for testing and production, and revoke it at once if it leaks.
- Keep it secret. Do not expose keys in code, public repositories, screenshots or chat.
- Store it properly. Use environment variables or a secrets manager.
- Set an expiry. OpenAI recommends an expiration date on project keys; Anthropic offers presets from 3 hours to never, set at creation.
- Rotate. Create a new key, update your apps, then revoke the old one.
- Separate environments. Use different projects or workspaces for testing and production.
- Limit spend. OpenAI limits and Anthropic limits.
- Monitor usage on each provider's usage page.
- If a key leaks: disable or delete it immediately and create a new one. Anthropic notes a lost key cannot be viewed again.
For public bots also read protecting a public bot. GPT Migrator stores keys encrypted and never shows them again.
Need your GPT running again without ChatGPT?
GPT Migrator can host your instructions and files as a standalone chat page for $47 per month. You bring your own OpenAI or Anthropic API key. It answers from your instructions and files and does not run GPT Actions.
See how hosting worksRelated guides
Sources
Pages describing other companies' products reflect their public documentation on the date shown and can go out of date.