Playbooks 8 min read· 18 Aug 2026· By Playbooks
Security best practices for API keys
Never ship a key to the browser. Here's the full playbook.
The single most common LLM security incident is a leaked key. Prevention is one architecture choice.
The rule#
Never put an sk-tb- key in browser code, mobile app bundles, or a public GitHub repo. Proxy through your own backend.
How TokenBaazar helps#
- Keys are hashed with a server-side pepper — even a full DB dump won't reveal them
- Per-key spend caps limit blast radius
- Per-key model restrictions
- One-click revocation from the dashboard
If you suspect a leak, rotate immediately from the dashboard — the old key stops working in seconds.