Never put API keys in website or app code that runs on the customer's device.Do not share keys in chats or emails.Revoke a key at once if you think it leaked, then create a new one.Use the IP whitelist when your package includes it.