Surf the Web Safely with API Keys and Tokens

Surf the Web Safely with API Keys

Cloud consoles, payment dashboards and AI playgrounds all show secrets that let someone else spend your money or read your data. Learn where API keys leak while you browse, how to keep tokens out of the browser, and how to rotate keys so a leak does less damage.

Six ways an API key escapes from your browser

Pages, extensions, the clipboard and your screen can all see what you paste.

🧩

Extensions with broad access

An extension that can "read and change all your data on all websites" can read every field on a dashboard page, including a key you reveal or paste. Keep the list short and remove extensions you no longer use.

📝

Autofill and saved form data

Browser autofill is built for login forms. A key saved as a password can be offered on the wrong field, and it syncs to every device signed in to that browser profile.

📋

Clipboard history

Windows clipboard history (Win+V) and clipboard managers keep copied text. A key you paste once can stay in that history.

🖥

Screen sharing and screenshots

A key revealed on a shared screen, in a recorded demo or in a bug-report screenshot is a leaked key. Reveal secrets only when nobody can see.

💾

Web storage in your own apps

Any script on the same origin can read localStorage and sessionStorage. One cross-site scripting (XSS) bug, or one compromised third-party script, exposes every token stored there.

🎣

Lookalike dashboards

A phishing copy of a cloud console collects a key as easily as a password. Open dashboards from bookmarks and check the domain.

Keep tokens out of the browser

The safest key never passes through a browser tab. When you must use a dashboard, limit how often a long-lived secret appears on screen and what it can do if it escapes.

Use a separate browser profile for consoles. Keep a profile with no extensions for cloud, payment and AI dashboards, and browse everywhere else in a different profile.
Prefer short-lived, scoped credentials. GitHub fine-grained personal access tokens can expire and be limited to single repositories. Stripe restricted keys grant only the permissions you select. On AWS, roles with temporary credentials replace long-lived access keys.
Keep secret keys on the server. Publishable keys, such as Stripe's, are designed for front-end code. Secret keys belong in server environment variables or a secrets manager, never in JavaScript that ships to the browser.
Store keys in an encrypted vault. A password manager or a secrets manager is far better than a notes app, a chat message or a text file on the desktop.
Turn on secret scanning. GitHub secret scanning and push protection detect many known token formats and can block a push before the key reaches a repository.

Rotate without downtime

Rotation limits how long a leaked key stays useful. An overlap rotation replaces a key without breaking the service.

Create

Create a new key with the same or narrower permissions.

Deploy

Put the new key in your secrets manager and redeploy every service that uses it.

Verify

Check the provider's logs: traffic uses the new key and the old key is idle.

Revoke

Delete or disable the old key. Write down the date so you know when the next rotation is due.

API Key Rotation Planner

Get a key's age, its next rotation date, and how long it would keep working if it leaked today.

Created or last rotated

Rotation interval

Enter the date the key was created or last rotated.

How it works: next rotation = last rotation + interval. If nobody notices a leak, the key keeps working until that date, so the days left are the exposure window. 90 days or less is the interval in the CIS Benchmarks for AWS and Google Cloud and in AWS Security Hub control IAM.3. The planner runs only in your browser. Never type a key into it or into any other web page.

Bar chart of how long a leaked API key stays valid in the worst case: 7 days with weekly rotation, 30 days monthly, 90 days with a 90-day interval, 365 days yearly — If nobody notices a leak, the key keeps working until the next scheduled rotation, so the rotation interval is the longest possible exposure window.

Common questions

Is it safe to store API keys in a password manager?

An end-to-end encrypted password manager is much safer than a text file, a notes app or a chat message. Store keys as secure notes rather than as logins, so the manager does not offer them for autofill on unrelated fields.

How often should I rotate API keys?

90 days or less is the interval used by the CIS Benchmarks for AWS and Google Cloud and by AWS Security Hub control IAM.3. Rotate at once after a suspected leak or when someone with access leaves.

What should I do first if I leak an API key?

Revoke or rotate the key first. Then check the provider's usage logs for calls you did not make, and only then clean up the place where it leaked. Deleting a commit or a message does not make a leaked key safe again.