An API key works like a password.
Anyone who has the key can use your account and credits. Keep it private.
Good habits
- Don't share the key. Don't send it over chat, email or in screenshots.
- Keep it out of source code and Git repositories. Store it in a password manager or secrets manager.
- Use a separate key for each app. If one leaks, you only need to replace that one. For example, create a key named "ResearchGangs - personal".
- Set an expiration where the provider allows it. Claude Console and OpenAI both offer this.
- Set spending limits or alerts to catch unusual use early: OpenAI offers spend alerts and hard spend limits; Gemini has a cap per billing account and billing alerts.
If you suspect a leak
- Create a new key at the provider.
- Use "Update API key" in ResearchGangs to replace it. Per-project access and conversations are kept.
- Disable or delete the old key at the provider.
- Check usage and billing logs for unexpected spending.
How ResearchGangs stores your key
ResearchGangs encrypts your API key and never shows it again after it is saved. Only the last few characters may be shown so you can tell keys apart. The key can be used only in projects you have granted. When you disconnect, all per-project access is revoked. See Connect AI to ResearchGangs.
Official sources
- Authentication: key types and expiration (Claude Platform Docs)
- Production best practices (OpenAI)
- Spend limits and alerts (OpenAI)
- Using Gemini API keys (Google AI for Developers)
- Billing (Google AI for Developers)
Checked against the provider's documentation on 28/10/2026. Their interface may change over time.