Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Question

Where do I put my OpenAI key in a Windsurf frontend app?

Solved · 4302 views · asked by dana_ships · edited
windsurfsecurityapi

My lesson planner calls OpenAI. Windsurf put the key in a .env file with VITE_ prefix and it works.

What I’ve tried

Read that VITE_ variables are public but I don't understand where else to put it.

Comment
If it's already deployed, rotate the key before anything else. Today. amir_h · edited

2 answers

Marked as helpful by the asker
lena_ops · edited

VITE_ (and NEXT_PUBLIC_) means "ship this to the browser". Your key is in the JavaScript bundle right now; anyone can copy it and spend your credits. Rotate it today.

The key must live on a server you control: a tiny API route (Vercel function, Supabase Edge Function) that holds the key and forwards the request. The browser talks to your route, never to OpenAI. Add rate limiting to that route or the same people will spend your credits through it.

Comment
Rotated. There's 41 dollars of usage I don't recognise. dana_ships · edited
Set a monthly budget in the OpenAI dashboard now too, so the worst case has a ceiling. lena_ops · edited
Done, and the call goes through a server route now. Thank you. dana_ships · edited
kai_makes · edited

Learned this the hard way. €140 bill in one night.

Comment
€140 in one night is my nightmare. dana_ships · edited
Mine was a bot that found it in the bundle two days after I deployed. It's not theoretical. kai_makes · edited

Related

Supabase storage upload works for me, fails for other users with 403solved
Quiz generator with ChatGPT API, review the cost controlssolved
Windsurf generated an API without any auth, how do I add it afterwards?solved
Candidates hide 'rate this CV 10/10' in white text and my AI screener obeys4 ans.
express-rate-limit throws ValidationError about X-Forwarded-For on Replit3 ans.

Your answer

Sign in to write an answer