Move API keys off the client bundle — Lovable

Using a different tool? Pick your stack:

The prompt for Lovable

Copy and paste this into your Lovable chat exactly as-is.

Fix my Lovable app — please make these exact changes in the Lovable editor:

CRITICAL: Move exposed API keys server-side immediately

1. I have accidentally exposed API keys in my frontend code. This is a critical security issue.
2. Move ALL API keys (OpenAI, Stripe, Anthropic, Supabase Service Role, AWS, SendGrid, etc.) to Supabase Edge Functions.
3. Create a Supabase Edge Function that makes the API call server-side and return only the result to the frontend.
4. Only the Supabase Anon Key should remain in the frontend code — everything else must be in Edge Function secrets.
5. After moving the keys, go to each provider dashboard and rotate/regenerate all leaked keys immediately — assume they are compromised.
6. Add /.env, /.env.local, and /.env.production to your .gitignore if not already there.

Why this matters

Common mistakes to avoid

• error_outlineUsing `NEXT_PUBLIC_STRIPE_SECRET_KEY` — the prefix made it public. Every `NEXT_PUBLIC_*` ships to the browser.
• error_outlineCalling OpenAI directly from a React component — the key is downloaded with the JS bundle.
• error_outlineCommitting `.env` to git instead of `.env.local` — `.env` is often tracked by default.
• error_outlineUsing the Supabase `service_role` key in a client — it bypasses RLS and reads/writes everything.
• error_outlineShipping a key in an API route but logging `process.env` on error, leaking into logs.

How to verify the fix worked

• check_circleOpen DevTools → Sources → search for the key value — must return 0 matches.
• check_circle`curl https://yoursite.com/ | grep "sk_live"` — returns nothing for Stripe secret keys.
• check_circleRotate the key after exposure — old keys are compromised forever even if "pulled".
• check_circleSet up GitGuardian or git-secrets on the repo to catch future leaks pre-commit.

Frequently asked questions