# API Key Safety

> Keep your Egon API key out of prompts, chats, and browser code when you build with AI: store it as a secret and call Egon from the server.

AI tools make it easy to **leak an API key**. Keep it out of prompts and out of the browser.

## Rules

- Never paste a real key into a chat or a prompt. Use `YOUR_API_KEY` or the name of an environment variable.
- Call Egon from your server. A key sent from the browser is visible to anyone who opens the page.
- Store the key in an environment variable or in your platform's secrets, such as `EGON_API_KEY`.

## Review Generated Code

Before you deploy code written by an AI tool, check that:

- the key is read from a secret, not written in the code;
- no request to Egon starts from the browser;
- responses are checked against the [Quality Indicators](https://documentation.egon.com/docs/quality-indicators.md) before the data is used.