This guide focuses on api keys in frontend code: why this mistake keeps happening. It starts with the decision a reader is likely facing, then explains the evidence and the smallest practical next step.

Quick answer

Any key shipped to the browser should be treated as public, even if it came from an environment variable.

Why people search this

Developers often paste keys into React or Next.js apps and wonder whether environment variables make them safe.

Search interest usually comes from a real moment: a suspicious message, a confusing setting, a job decision, a technical bug, or a content question that affects traffic. The best answer should reduce panic and increase judgment.

Mental model

Frontend code runs on someone else’s device. If the browser can use the key, users and attackers can usually inspect it.

| Situation | Better question | |