GetSEO
All guides

Security guide

API Key Security Best Practices

A leaked AI key is someone else's bill. The habits below take a few minutes to set up and remove almost all of the risk of using your own key in a browser tool.

Step by step

  1. 1

    Cap spend before you create the key

    Every provider offers a monthly budget or a per-key credit limit. Set it first. A cap turns a worst case leak into a small annoyance.

  2. 2

    Use one key per tool

    Name keys after where they are used. When something looks wrong you can revoke exactly one key without breaking your other work.

  3. 3

    Never commit a key

    Keys do not belong in source control, screenshots, support tickets or shared docs. Providers scan public repositories and will disable exposed keys, but not always before someone uses them.

  4. 4

    Rotate on a schedule

    Replace keys every few months, and immediately after sharing a screen recording or handing a laptop to someone else.

  5. 5

    Know where GetSEO stores yours

    Your keys live in your browser's local storage on your device. Calls go straight from your browser to the provider. We have no server that could store or read them, which is the entire point of the BYOK model.

  6. 6

    Clear keys on shared machines

    Use the remove option in the settings drawer when you finish on a device that is not yours.

Use your key in GetSEO

Open the settings drawer from the top bar, add the key, and it is saved in your browser only. You can add several keys and GetSEO will fail over between them automatically.

Worth knowing

  • A spend cap is worth more than any other precaution.
  • Browser local storage is per device and per browser profile; clearing site data removes your keys.
  • Anyone with physical access to an unlocked machine can read local storage, so lock your screen.

Troubleshooting

ProblemFix
Your key was disabled by the providerIt was detected in a public location. Revoke it, create a new one, and check where it leaked.
Unexpected usage on your accountRevoke every key immediately, then recreate them one tool at a time with per-key limits.
Keys disappeared from GetSEOSite data was cleared or you are in a different browser profile. Paste them again; nothing was sent anywhere.

Keep reading

What BYOK actually meansThe model that makes this tool free rather than freemium.Fixing API key errorsWhat each provider error code really means.Run a free website auditPut your new key to work and get a full growth report in a couple of minutes.

Key ready? Run your free audit.

Paste your URL and get a scored report across SEO, conversion, content, accessibility, mobile and trust, with the fixes written for you.

Run a free audit