Skip to content

API key security: storage, limits and leaks

Protect your 5abeer API keys and account: where to keep a key, the limits to set on each one, what to do if it leaks, and what we never ask for.

Updated October 3, 2026
On this page

An API key works like a password: whoever holds it can send requests that are charged to your balance. Keep it somewhere safe, and give each key limits that fit what it is for.

Keep the key somewhere safe#

  • Keep it in the KHABEER_API_KEY environment variable or in your server's secret store, not in the code itself. Details in Keep the key in an environment variable.
  • Never put it in code that runs in the browser or in a phone app, where any visitor can read it. Send requests from your server.
  • Never commit it to a code repository. Keep it in a .env file and add that file to .gitignore.
  • Never paste it into a screenshot, a chat or a message to support.

Set limits on each key#

Control every key: a spend limit, an expiry date and an IP allow-list.

  • Use one key per project or per person, so you can stop one key without touching the others.
  • Set a spend limit that fits the project, so the key can't go past it even if it leaks.
  • If your servers have fixed IP addresses, restrict the key to them.
  • Give temporary keys an expiry date.

You set these limits when you create a key, or later in its settings, as in Control every key.

If a key leaks#

  1. Stop the key now#

    Open the keys page in the dashboard and choose Rotate key: a new key replaces it and the current one stops as soon as that succeeds. Or choose Turn key off to stop it now.

  2. Update your tools#

    Put the new key in your environment variable and in every tool or server that used the old one.

  3. Review the usage#

    Review the key's usage and cost in the dashboard. If you see usage you don't recognise, contact us with the key's name, never the key itself.

Protect your account#

  • You can reveal your keys again at any time from the keys page, so protecting your account is part of protecting your keys.
  • Use a strong password that you don't use on any other site.
  • If you sign in with Google or GitHub, turn on two-step verification in that account.
  • Sign out on shared devices. If you think someone got into your account, choose a new password: saving it signs your account out on every device, as in Forgot your password.

What we will never ask for#

Never send your API key or password to anyone; our team will never ask for them. If you contact us about a problem, send the error code, the time of the request and the key's name only.