I’m working on a web application that uses several third-party APIs, and I’m trying to follow the best security practices for managing API keys. I understand that exposing API keys in client-side code can create security risks, so I’m interested in learning how experienced developers handle this.What methods do you recommend for protecting API keys in production? Do you use environment variables, secret management services, or backend proxies to keep credentials secure? Are there any common mistakes that beginners should avoid?I’d also appreciate recommendations for tools or workflows that make API key management easier during development while still maintaining strong security in production.
Hi @Richard_Wright 
welcome to the Apigee forum! We’re thrilled to have you here.
We’ve seen your question and encourage other community members to share their preferred workflows and best practices.
In the meantime, we encourage you to check out our latest Apigee Community TechTalk recordings on similar architecture and security patterns:
Be sure to also register for our upcoming live sessions to connect directly with experts! 
Google Cloud Apigee Community TechTalks
Google Cloud’s Secret Manager is my tool of choice for storing API Keys and other sensitive credentials.
Hi,
Allow me provide some POV (points of view) here.
For the actual production:
- If you are hosting your apps (containing the API Key) in the major cloud solution, most (if not all) should have Secret Manager / Store. In GCP, it’s GCP Secret Manager.
- Likewise, if you are hosting your apps on-premise, there are solution such as HashiCorp’s Vault or likely other similar solution.
They should be loaded during the app startup / runtime and dynamically fetch from the secret stores.
For the development:
It’s common to place them into the .env file (for Node, etc.).
While most of the time they are “ignored” by version control like .gitignore. It’s still better to explicitly check / do so.