Security
Protecting API keys in AI-generated applications
Where secrets belong, where they don't, and how to connect services safely without exposing your keys.
A leaked API key can mean real cost and real risk. The good news: keeping keys safe is mostly about putting them in the right place.
The one rule
Secret keys belong on the server, never in the browser. Anything shipped to the client can be read by anyone who visits your site — including keys accidentally embedded in the code.
How Getyn handles it
- Connector secrets are stored encrypted, server-side.
- They're injected into your backend at runtime, not bundled.
- Public tokens (the kind meant for browsers) are handled separately.
What you should still do
- Rotate a key immediately if it's ever exposed.
- Scope keys to the minimum access they need.
- Watch provider dashboards for unexpected usage.
Pair this with the founder's guide to application security.