# API key hygiene for Anthropic integrations
1. The API key lives on the server: in your host's secret store, injected as an environment variable at deploy time, passed to the SDK client constructor. It never appears in frontend bundles, mobile apps, or client components.
2. The TypeScript SDK supports browser runtimes, which makes it easy to accidentally call the API from frontend code with the key attached. Do not. Every browser-callable path must go through your own backend endpoint instead.
3. In Next.js, the key must not use a public-prefixed variable name; public-prefixed variables are inlined into client JavaScript at build time.
4. Use separate keys per environment (development, staging, production). A leaked dev key then has a bounded blast radius, and rotation does not require touching production.
5. If a key is ever committed, pasted into a chat, or shipped to a client, treat it as compromised: rotate it immediately in the Anthropic Console and update the secret store. There is no "probably fine" for an exposed key.
6. Monitor usage per key. An unexpected spend spike is often the first signal that a key escaped its intended environment.
Failure modes this prevents: keys inlined into client bundles via public env vars; one shared key across all environments; slow rotation after an accidental commit.