LeakPatrolIs this API key safe in my frontend?
Paste a key or token below to see what it is and whether it's allowed in your app's frontend code (anything in a VITE_, NEXT_PUBLIC_ or REACT_APP_ variable ends up there). The check runs entirely in your browser: the key is never sent to us or anywhere else.
Public keys vs secret keys
Some keys are designed to be in the browser: they only identify your project, and the real protection lives somewhere else (Row Level Security in Supabase, domain restrictions in Google Cloud). Secret keys are different: whoever holds one can act as you, spend your money or read your data, and every visitor to your site can read your frontend code.
| Key | Starts with | In the frontend? |
|---|---|---|
| Supabase anon / publishable key | eyJ… (role anon), sb_publishable_ | Yes, with RLS on every table |
| Supabase service_role / secret key | eyJ… (role service_role), sb_secret_ | Never |
| Stripe publishable key | pk_live_, pk_test_ | Yes |
| Stripe secret key | sk_live_, sk_test_, rk_live_ | Never |
| OpenAI | sk-proj-, sk- | Never |
| Anthropic | sk-ant- | Never |
| Firebase / Google Maps | AIza | Yes, if restricted to your site and APIs |
| AWS | AKIA, ASIA | Never |
| Resend, SendGrid | re_, SG. | Never |
If a secret key was in your frontend
- Rotate it in the provider's dashboard. Removing it from your code isn't enough: it's already been downloaded.
- Move the call to a server, such as a Supabase Edge Function or an API route, that reads the key from a secret.
- Rename the variable so it doesn't start with
VITE_,NEXT_PUBLIC_orREACT_APP_. - Set a spend limit for AI providers, and check their usage logs for anything you don't recognise.
Not sure which keys your live app is shipping? The free LeakPatrol scan reads every JavaScript file your site loads and lists any secret keys it finds (masked), plus public .env files and missing protections.
Check your app in a minute
Free, read-only, no sign-up. Every problem comes with a plain-English fix and a prompt for your AI tool.
Get the 10-point checklist
Every check we run on AI-built apps, with how to do each one yourself. Straight to your inbox.
Plus an email when automatic re-checks launch, and the odd tip. Unsubscribe any time.
Questions
Is the Supabase anon key safe in the frontend?
Yes. The anon (or publishable) key is meant to be public. Your data is protected by Row Level Security, so make sure RLS is enabled on every table with policies that only allow what each user should see.
Is the Supabase service_role key safe in the frontend?
No. The service_role key (and the newer sb_secret_ key) bypasses Row Level Security and can read and change your whole database. Keep it in Edge Functions or on a server only, and rotate it if it was ever exposed.
Is a Firebase API key a secret?
No. Firebase API keys starting with AIza are designed to be in the browser, but restrict them to your website and the APIs you use in Google Cloud, and protect data with Firebase security rules.
Does this tool send my key anywhere?
No. The check runs in your browser using only the key format. Nothing you paste is sent to LeakPatrol or anyone else.
More guides
- Supabase RLS policy generator (free)
- Supabase's October 30 change: what it fixes for your app's security, and what it doesn't
- Lovable security check: is your Lovable app safe?
- Bolt.new security check: is your Bolt app safe?
- Launch checklist for apps built with Lovable, Bolt and Cursor
- Supabase security check: is your anon key safe? (RLS checker)
- How to check if your API key is exposed on your website
- Are VITE_ env variables secret? How to hide API keys