How to Secure Your AI API Keys in Production

# .env file (add to .gitignore!)
IZZI_API_KEY=izzi-YOUR_KEY_HERE
IZZI_BASE_URL=https://api.izziapi.com/v1

# Python
import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["IZZI_API_KEY"],
    base_url=os.environ["IZZI_BASE_URL"]
)

// Node.js
import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.IZZI_API_KEY!,
  baseURL: process.env.IZZI_BASE_URL!,
});

# .gitignore — MUST include these
.env
.env.local
.env.production
*.key
*.pem
config/secrets.yml

# .git/hooks/pre-commit
#!/bin/sh
if git diff --cached --name-only | grep -E '\.(env|key|pem)

Level 3: Secret managers (production)
AWS Secrets Manager

    

      Python
      Copy
    
    
import boto3
import json

def get_api_key() -> str:
    client = boto3.client("secretsmanager", region_name="us-east-1")
    response = client.get_secret_value(SecretId="izzi-api-key")
    secret = json.loads(response["SecretString"])
    return secret["api_key"]
  

Docker secrets

    

      YAML
      Copy
    
    
# docker-compose.yml
services:
  app:
    image: myapp
    secrets:
      - izzi_api_key
    environment:
      - IZZI_API_KEY_FILE=/run/secrets/izzi_api_key

secrets:
  izzi_api_key:
    file: ./secrets/izzi_api_key.txt
  

Level 4: Key rotation
Rotate your API keys every 90 days. On Izzi API:

Go to Dashboard → API Keys
Create a new key
Update your environment/secret manager
Verify the new key works
Delete the old key



    

      Python
      Copy
    
    
def rotate_key():
    """Automated key rotation pattern."""
    new_key = create_new_izzi_key()
    update_secret_manager("izzi-api-key", new_key)
    
    # Verify new key works
    test_client = OpenAI(api_key=new_key, base_url="https://api.izziapi.com/v1")
    test_client.chat.completions.create(
        model="qwen3-30b-a3b",  # Use free model for testing
        messages=[{"role": "user", "content": "ping"}],
        max_tokens=5
    )
    
    # Delete old key after verification
    delete_old_izzi_key(old_key_id)
  

Security checklist

Check
Level
Done?
No hardcoded keys in source code
Critical
☐
.env files in .gitignore
Critical
☐
Pre-commit hook for leak detection
Important
☐
Secret manager in production
Important
☐
Key rotation every 90 days
Best practice
☐
Separate keys per environment
Best practice
☐
Monitor usage for anomalies
Best practice
☐


What's next

Get started with Izzi API
Reduce your API costs by 80%

; then
  echo "ERROR: Attempting to commit secret files!"
  exit 1
fi

if git diff --cached -U0 | grep -E '(izzi-|sk-|gsk_|AIza)'; then
  echo "ERROR: API key detected in staged changes!"
  exit 1
fi