How to secure AI API keys
A sourced rotation checklist plus our own scanner and vault tests. Tested Oct 22, 2026 (2026-10-22): 4 fake keys in public formats, 10 decoys, no accounts, trufflehog run with no verification calls (fake keys were never sent to any provider). One run, one machine, one fixture.
If your keys were exposed (do this now)
Railway's own disclosure of Oct 21, 2026 says an unauthorized third party “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” Railway believes this is part of attacks on platform companies “with the aim of compromising AI inference providers,” and recommends that all users roll all environment variables stored in Railway, including API keys, plus private registry credentials, and review logs for unusual activity. Source: Railway blog, Oct 21, 2026. We add nothing beyond Railway's own posts and status page.
Railway's status page says all Railway API and Project tokens created before the incident were invalidated (updates of Oct 22, 04:17 and 17:00 UTC). Source: status.railway.com.
Railway also published per-service guides, including checks for unexpected OpenAI, Anthropic, Grok and OpenRouter usage: check for unexpected OpenAI usage · check for unexpected Anthropic usage.
Railway's Preliminary Incident Report is pending as of Oct 22, 2026 (not yet published at the status page's Oct 23 00:51 UTC update).
Key rotation checklist (11 steps)
- Inventory every key; use one key per person, agent and environment. OpenAI: give each team member a unique key; sharing keys is against its Terms. Anthropic: keep separate keys for dev, test and prod. [OpenAI §1] [Anthropic §5]
- Create keys with an expiration date. OpenAI admins can enforce a maximum key lifetime. [OpenAI §2]
- Rotate: create the replacement, update apps, verify, then revoke the old key. Anthropic suggests a consistent schedule, “for example, every 90 days”. [OpenAI §2] [Anthropic §4]
- If a key leaked, revoke or rotate it now. OpenAI: rotate immediately from the API Keys page and contact help.openai.com. Anthropic: Console → API keys (platform.claude.com/settings/keys) → menu → “Delete API key”. [OpenAI §7] [Anthropic FAQ]
- Set spend guards. OpenAI: monthly spend limits with hard enforcement (“Spend alerts alone don't stop API traffic”). Anthropic: spend limits or workspace rate limits, or careful auto-reload limits. [OpenAI §7] [Anthropic §2]
- Never put keys in client-side code or commit them; keep .env in .gitignore. [OpenAI §3–4] [Anthropic §3]
- Scan repos and CI, and enable provider secret scanning. Anthropic names Gitleaks, and says GitHub notifies it of Claude keys exposed in public repos, which it deactivates automatically. [Anthropic §6] [GitHub secret scanning]
- Use a key management service (KMS). [OpenAI §6] [Anthropic §7]
- Add network controls. OpenAI: IP allowlisting, and workload identity federation instead of long-lived keys where supported. [OpenAI §2, §8]
- Monitor the usage and logs pages. [OpenAI §7] [Anthropic §2]
- If your keys lived on Railway, follow Railway's disclosure. Roll all environment variables and review logs (see above). [Railway, Oct 21 2026]
Secret scanners: what found our fake keys
Fixture: a local git repo with no remote. A fake OpenAI key committed then deleted (history only), fake Anthropic and OpenAI keys in an untracked .env, a fake Anthropic key in a tracked .env.example, and 10 decoy non-secrets. “Found” means the pattern matched; no key was verified live.
| Tool | Version | Install time (median of 3) | Fake OpenAI key in git history | Fake Anthropic key in .env | .env.example | False positives (of 10 decoys) | CI / pre-commit | MCP / agent integration | Free-tier limits |
|---|---|---|---|---|---|---|---|---|---|
| gitleaks | 8.30.1 | 0.50 s (download + first command, not a clean install) | Yes (openai-api-key, gitleaks git) | Yes (gitleaks dir; untracked .env is invisible to git mode) | Yes | 0 | Yes, observed (--pre-commit --staged exited 1) | not checked in this run | Open source (MIT); not checked in this run |
| trufflehog | 3.99.4 | 1.45 s (download + first command, not a clean install) | Yes (OpenAI detector) | Yes (filesystem mode) | Yes | 0 | Yes, observed (filesystem --fail exited 183); git pre-commit form not exercised | not checked in this run | Open source (AGPL-3.0); not checked in this run |
| detect-secrets | 1.5.0 | 0.30 s (download + first command, not a clean install) (run 1: 1.68 s cold; runs 2–3 used the uv cache) | No (no git-history mode) | No (no Anthropic rule; it flagged the OpenAI key in .env) | No | 7 | Yes, observed (detect-secrets-hook exited 1) | not checked in this run | Open source (Apache-2.0); not checked in this run |
| GitHub secret scanning | n/a | n/a | not tested, needs account | not tested, needs account | not tested, needs account | not tested, needs account | Documented only, not verified | not checked in this run | not checked in this run |
Infisical CLI 0.44.8 also has a local infisical scan with no account; its results matched gitleaks rule for rule.
Secret managers and vaults
HashiCorp Vault was tested in local dev mode only (in-memory, root token): production setups, auth methods and dynamic-secret rotation were not tested.
| Tool | Version | Install time (median of 3) | Inject fake key into a process | Rotation | Audit log | Detects leaks itself? | MCP / agent integration | Free-tier limits |
|---|---|---|---|---|---|---|---|---|
| 1Password CLI / Service Accounts | op 2.41.1 | 0.49 s (download + first command, not a clean install) | not tested, needs account (offline op run: “no account found”) | not tested, needs account | not tested, needs account | not tested, needs account | not checked in this run | not checked in this run |
| Doppler | CLI v3.77.1 | 0.21 s (download + first command, not a clean install) | not tested, needs account (“you must provide a token”) | not tested, needs account | not tested, needs account | not tested, needs account | not checked in this run | not checked in this run |
| Infisical | CLI 0.44.8 | 1.17 s (download + first command, not a clean install) | not tested, needs account (self-hosting needs Docker, not available on the test box) | not tested, needs account | not tested, needs account | Yes, observed: infisical scan runs locally with no account; found the history key and all 3 working-tree keys, 0 of 10 decoys | not checked in this run | not checked in this run |
| HashiCorp Vault (OSS), local dev mode only | v2.2.1 (dev server) | 3.46 s (download + first command, not a clean install) | Yes (vault kv get -field into a child process; value matched) | Manual only: KV v2 versioning observed (v1 still retrievable after a second put). Dynamic secrets documented, not exercised | Yes (OSS file audit device; secret value HMAC'd, 0 plaintext matches) | No (not a scanner) | not checked in this run | OSS; no account for dev mode |
| Bitwarden Secrets Manager | bws 2.1.0 | 0.32 s (download + first command, not a clean install) | not tested, needs account (“Missing access token”) | not tested, needs account | not tested, needs account | not tested, needs account | not checked in this run | not checked in this run |
| AWS Secrets Manager | n/a | n/a | Skipped (requires billing) | Skipped | Skipped | Skipped | Skipped | Skipped |
| GCP Secret Manager | n/a | n/a | Skipped (requires billing) | Skipped | Skipped | Skipped | Skipped | Skipped |
What we haven't tested
- Everything marked “not tested, needs account”: we created no accounts.
- MCP / agent integration for every tool: not checked in this run.
- Free-tier limits: not copied from vendor pricing pages in this run.
- Install times are download + extract + first command, not clean-container installs.
- Vault beyond local dev mode; AWS and GCP (skipped, need billing).
- Recall on other key formats: only 4 planted keys and 10 decoys.
No product here is rated or ranked, and this page has no affiliate links. How we test: methodology. Related: MCP servers that need an API key.
Sources (accessed 2026-10-22)
- OpenAI, Best practices for API key safety
- Anthropic, API key best practices
- Anthropic Admin API, update API key
- GitHub, About secret scanning
- Railway, Security Disclosure: Wednesday October 21st (Oct 21, 2026)
- Railway status page (Oct 22–23, 2026 UTC updates)
- Railway, check for unexpected OpenAI usage
- Railway, check for unexpected Anthropic usage
Last tested 2026-10-22