Treat API keys as secrets. Store them in server-side environment variables or an approved secret manager—never in public repositories, browser code, distributed mobile binaries, chat messages, or screenshots.
Restrict who and what can access keys; avoid logging them.