Skip to content

Security and governanceChecklist

AI API key security checklist: 48 controls to verify

Forty-eight one-line controls for the keys that spend money on your AI provider accounts, grouped by the moment they apply, each linked to the guide that explains it. Use it as a review: every item should end in evidence or a decision that it does not apply.

By INFRO Editorial

Published

6 min read

A grid of dark glass cards with small bar charts, a few of them lit amber, on a dark ground

In short

Secure AI API keys by giving every application, environment, agent and third-party tool its own key, scoped at the provider and capped with a provider spend limit; keeping keys in a secrets manager, never in code, browsers or mobile apps; recording every key in an inventory; watching usage at the provider; rotating on a schedule with an overlap; and rehearsing revocation before you need it.

Key takeaways

  • One key per application, environment, agent and third-party tool, so revoking one never breaks another.
  • Scope every key at the provider and cap it with a provider spend limit; that is the only control that still applies to a stolen key.
  • Keep an inventory, watch usage at the provider, and rehearse revocation before an incident makes you.
On this page
  1. Create
  2. Store
  3. Scope
  4. Use in applications
  5. Agents and tools
  6. Monitor
  7. Limit spend
  8. Rotate
  9. Revoke
  10. Third parties
  11. Incident
  12. How INFRO covers part of this list

How do you secure an AI API key? Give every application, environment, agent and third-party tool its own key; scope each one at the provider and cap it with a provider spend limit; keep keys in a secrets manager and never in code, browsers or mobile apps; record every key in an inventory; watch usage at the provider; rotate with an overlap on a schedule; and rehearse revocation before you need it. The 48 controls below break that down by the moment each applies.

Use this as a review, not a reading list. Each item should end with evidence — a screenshot of a limit, an inventory row, a rotation log — or a recorded decision that it does not apply. Each links to the guide that explains it.

Create

Store

Scope

Use in applications

Agents and tools

Monitor

Limit spend

  • A hard spend limit on every project or workspace a key lives in; OpenAI's fails requests with a 429 once reached6 (provider) (provider spend limits compared).
  • Spend alerts set below each hard limit; OpenAI notes alerts alone do not cap spend6 (provider).
  • Per-key and per-project caps enforced before the provider is called (LLM spend limits compared).
  • The worst case for a stolen key worked out and accepted in writing (cap a stolen AI key's damage).

Rotate

Revoke

  • Each team knows how to revoke each of its keys in minutes; OpenAI says revocation takes effect within a few seconds2 (provider).
  • Revocation rehearsed once per key, end to end, including confirming the old key fails (leaked OpenAI API key).
  • Replacing a key inside a gateway or tool is followed by revoking it at the provider (BYOK credential architecture).

Third parties

Incident

How INFRO covers part of this list

INFRO is a gateway in front of the provider accounts you connect, so it covers the items about traffic that passes through it. Provider keys are encrypted with AES-256-GCM under a key held outside the database and never shown again. Applications and coding agents use INFRO gateway keys, stored as a SHA-256 digest, each belonging to one environment, optionally limited to chosen providers or IP ranges (403 ip_not_allowed before any provider call), with expiry and rotation with an overlap of none, 1 hour, 24 hours or 7 days (authentication). Model allowlists, hard budgets per organization, project, member and key checked before the provider is called, spend alerts and the audit log cover the matching items; on the Business plan, reconciliation with usage access reports OpenAI and Anthropic usage on a connected key that did not go through INFRO.

It does not cover the items marked (provider). A provider key stolen from anywhere, INFRO included, can be used directly at the provider, so scope it, cap it and watch it there as well.

Questions readers ask

What are OpenAI API key best practices?
Keep the key server-side and out of code and repositories, load it from an environment variable or secrets manager, use a separate project key per application and environment with an expiration date, set a hard spend limit on the project, monitor usage, and rotate on a schedule by creating a replacement, deploying it, and revoking the old key.
How often should I rotate AI API keys?
On a fixed schedule you can sustain, set by the key's exposure and your policy, and immediately on any suspicion of exposure. More important than the interval is that rotation is rehearsed: create the replacement, deploy it, confirm it works, revoke the old key and confirm the old key fails.
What is the single most important control for an AI API key?
A provider-side spend limit on a dedicated, scoped key. Every other control can be bypassed by someone who has the key and calls the provider directly; the provider's limit and the key's scope still apply.

From the team that builds it

Where this shows up in INFRO

INFRO is a control plane in front of the provider accounts you already hold. The capabilities below are the parts of it this article touches, each with the documentation that defines its behaviour.

  • Provider connections

    Available with a plan

    Connect provider accounts you already hold. Each credential is encrypted when saved, scoped to your organization and never shown again; applications use INFRO gateway keys instead.

    Read the documentation for Provider connections

  • Key limits and rotation

    Available with a plan

    Limit a gateway key to chosen providers or IP ranges, and rotate it with an overlap window so the old key keeps working while you deploy the new one.

    Read the documentation for Key limits and rotation

  • Environments

    Available with a plan

    Production, staging and development to start, and your own beside them. A connection or route serves one, several or every environment; each gateway key belongs to exactly one, and never reaches a connection outside it.

    Read the documentation for Environments

  • Budgets and spend ceilings

    Available with a plan

    A hard cap per organization, project, member, and key, with alerts at your own thresholds.

    Read the documentation for Budgets and spend ceilings

  • Model allowlists

    Available with a plan

    Approve which models a project may call; anything else returns a policy error instead of a line item.

    Read the documentation for Model allowlists

  • Spend anomaly and drift alerts

    Available with a plan

    Each scope's usual day is learned from its own history; a day that departs from it, a budget forecast to be exceeded, cost estimates drifting from the provider's own figures, unpriced traffic and failing connections become findings in the console. Routed to email on every plan, and to Slack and signed webhooks from the Startup plan.

    Read the documentation for Spend anomaly and drift alerts

  • Audit log

    Available with a plan

    Member, key, and policy changes recorded with actor and timestamp, viewable in the console.

    Read the documentation for Audit log

  • Provider cost reconciliation

    Available with a plan

    Daily comparison of estimated spend against the cost reported by OpenAI's and Anthropic's own cost APIs, using a separate admin credential, with the likely cause of a persistent gap and a suggested rate you can apply. Included on the Business plan.

    Read the documentation for Provider cost reconciliation

  • Claude Code and Codex through INFRO

    Available with a plan

    Point Claude Code, the Claude Agent SDK, Codex or the OpenAI Agents SDK at INFRO by changing the base URL and the key. Anthropic's Messages API and OpenAI's Responses API, with routing, budgets refused before the call, guardrails and the request log applied as on every other request.

  • MCP gateway for your agents' tools

    Available with a plan

    Register your own MCP servers once with their credentials, approve and pin each tool's definition, grant gateway keys access, and let agents call those tools through INFRO with guardrails, a call log on the same trace as their model calls, and kill switches checked on every call. INFRO executes no tool.

    Read the documentation for MCP gateway for your agents' tools

INFRO accounts are self-serve. Provider usage is billed to you by your providers; INFRO charges a software subscription and takes 0% of model spend. See plans.

Sources

Numbered in order of first citation. Each was opened and checked against the claim on the date shown.

  1. 1.Production best practices (opens in a new tab) — OpenAI. Accessed Oct 21, 2026.
  2. 2.API reference: Authentication (opens in a new tab) — OpenAI. Accessed Oct 21, 2026.
  3. 3.Secrets Management Cheat Sheet (opens in a new tab) — OWASP. Accessed Oct 21, 2026.
  4. 4.Creating and managing Workspaces in the Claude Console (opens in a new tab) — Anthropic. Accessed Oct 21, 2026.
  5. 5.Best practices for managing API keys (opens in a new tab) — Google Cloud. Accessed Oct 21, 2026.
  6. 6.Spend limits (opens in a new tab) — OpenAI. Accessed Oct 21, 2026.

About this article

Provider controls are taken from OpenAI's, Anthropic's and Google Cloud's documentation, and storage and incident guidance from the OWASP Secrets Management Cheat Sheet, all opened on 2026-10-21. Each item links to the guide on this blog that explains it. Written by the team that builds INFRO.

Last checked against its sources on . The next review is due by . No separate named reviewer is recorded for this article.

How articles are written, sourced and corrected is set out in the editorial standards.

Read next