How to Store AI API Keys Safely in Env Files, Skills and Plugins

Key takeaways

• Keep a master copy of each key in a password manager, not in a text file
• A .env file is fine for local tools if it never reaches GitHub or a shared folder
• Search for keys hiding in skills, prompts and notes, and move them out
• Only give plugins keys from makers you trust, and use a separate key for each
• Use one key per app so a leak can be shut down without breaking everything
• Pair good storage with a spending limit, because no storage method is perfect

Most leaked keys are not stolen by clever hacking. They sit in a file, a note or a plugin setting that someone else can reach.

This guide answers one question: how do you store AI API keys safely in env files, skills and plugins? It builds on our main article, The OpenCode Breach: How to Protect Your AI API Keys Now, where Mark Kashef warns that people have stopped checking where their keys end up.

Where do AI API keys usually leak from?

From convenience. Mark lists three quiet risks: skills with a key written straight into them, env files holding every key you own, and plugins nobody checked. We would add a few more common ones:

How do you store AI API keys safely?

1. List every key you have created, by provider, and what each one is for.
2. Save the master copy of each key in a password manager or secrets store.
3. Search your computer and cloud drive for key patterns, such as text starting sk-, and for words like “api_key”.
4. Move any key you find out of skills, notes and documents, then delete it from that file.
5. Replace any key that was ever shared or committed, by deleting it at the provider and creating a new one.
6. Give each app its own key and name it after the app.
7. Set a spending limit on every provider, following How to Set an AI API Spending Limit and Usage Alert.

How should you handle .env files?

Keep them local, minimal and out of anything you share. A .env file is a plain text file that tools read for settings such as keys.

• Add .env to your .gitignore so it is never committed to a repository
• Keep it out of synced folders such as Dropbox, OneDrive or Google Drive
• Only include the keys that project needs, not every key you own
• Share a .env.example file with blank values if others need to know the format
• If you ask an AI coding agent to set up a project, check it has not written keys into other files

How do you check skills and plugins for keys?

Read before you install, and never paste your main key into something you cannot inspect.

• Open the skill file and look for anything that looks like a key or a web address it sends data to
• Check who made a plugin, when it was last updated and what permissions it asks for
• Use a separate, low-limit key for any plugin you are trying out
• Remove plugins you no longer use, and delete their keys at the provider

Our three-question test for new AI skills and plugin checklist give you a quick routine. Mark also mentions Lockpick, a free scanner built by his own team, which is one option among several.

Which storage option fits you?

What mistakes should you avoid?

• Pasting keys into chats, emails or shared docs
• Using one key across every tool and plugin
• Assuming a private repository is a safe place for keys
• Forgetting old projects that still hold working keys
• Skipping the spending limit because storage “feels” secure

Frequently asked questions

The bottom line

Storing AI API keys safely is mostly about tidiness. Keep one master copy in a password manager, keep .env files local and out of repositories, take keys out of skills and notes, and give each plugin its own low-limit key. Then add a spending cap, because even good storage can fail.

Related posts

• How to Audit Your Claude and Codex Setup and Clear Out AI Clutter
• Should You Install a New AI Skill? A Simple 3-Question Test
• How to Keep Your AI Agent Safe When It Browses the Open Web

Garry Knight

I'm Garry Knight, the person behind Prodify Digital. I write about email list building, email marketing, SEO, AI search and the tools that connect them. My aim is to make online marketing easier to understand, so creators and small business owners can make informed decisions about building an audience and keeping people engaged. Here you'll find straightforward guides and product reviews that explain what something does, where it fits and which limitations matter. The focus is on clear explanations and useful next steps—not hype, shortcuts or promises of easy earnings.

See Full Bio