Free tool · no sign-up

Is your API key visible to every visitor?

Built your app with Lovable, Bolt, Replit, v0 or Cursor? A secret key can end up inside the code every visitor’s browser downloads. Anyone can copy it and run up your bill. Paste your website’s address and we’ll check.

What this checks

• Your page and the script files it loads from your own site — the same files any visitor’s browser downloads.
• Secret key formats from OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase, Groq, Hugging Face, SendGrid, Slack and more.
• Secret-sounding VITE_, NEXT_PUBLIC_, REACT_APP_ and EXPO_PUBLIC_ settings built into the browser code. Keys that are public on purpose (Stripe publishable keys, Supabase anon keys) are skipped.

What it does not do

• It does not log in, guess passwords or try any key. It only reads public files.
• It never shows a whole key — only the first and last few characters, so you can tell which one it is.
• It stores nothing: not your address, not the results.
• It can miss things: scripts your page loads later, or from other sites, are not checked. A clean result is not a guarantee.

Found a key? Do this

1. Cancel the key on the provider’s website and make a new one. Hiding it now is not enough: it has already been public.
2. Move the call to your server (a serverless function, Supabase edge function or Vercel/Netlify function) and keep the key in that host’s secret settings, never in a VITE_ or NEXT_PUBLIC_ variable.
3. Set a spending limit at the provider so a leak can’t empty your account.

Using an AI coding tool? Our free, open-source OathKey lets the AI use your keys without seeing them, and oathkey scan --bundle dist/ runs this same check on your computer before you publish. Stuck? Call Cara at 431-244-9026 or email [email protected].

Please only check sites you own or run. This tool reads public files only, as any browser does.