Most business owners think an API key is a technical detail, something the developer worries about and nobody else needs to understand. That belief is costing real money in 2026.
In February, a three-person startup that normally spent about US$180 a month on Google's Gemini models woke up to a bill of US$82,314.44, run up in 48 hours with a stolen key, according to Techloy. In October alone, two separate incidents put thousands of businesses' AI keys at risk in the same week.
An AI API key is not a password for your developer. It is closer to a company credit card that anyone holding it can use, with no PIN and often no spending limit. This guide explains what it is, how it leaks, and the simple habits that keep it safe.
What is an AI API key?
An AI API key is a long secret code that lets software use an AI model, such as ChatGPT, Claude or Gemini, and charge the cost to your account. Whoever presents the key gets the service, and you receive the bill. It works like a company credit card number for AI, without a PIN.
API stands for application programming interface, which simply means a doorway that lets one program talk to another. When your website chatbot, booking assistant or automation tool "uses ChatGPT", it is usually knocking on that doorway and showing your key.
A typical key looks like a random string of 40 to 100 letters and numbers. It does not expire on its own, it does not ask who is using it, and it does not care whether the request comes from your office or from another continent.
How does an AI API key work?
Every time a program sends a request with your key, the AI provider runs the model and records the usage against your account. You are billed by volume, usually per million tokens, which are small chunks of text. There is no monthly cap unless you set one, so heavy use means a heavy bill.
This is very different from a normal ChatGPT or Claude subscription. A subscription has a fixed monthly price and a login tied to one person. If someone uses your login too much, they hit a usage limit and wait.
An API key has no such brake by default. It is pay-as-you-go, like a taxi meter that keeps running for as long as anyone sits in the car.
A simple way to picture the difference:
--- Subscription login: a staff canteen card with a fixed monthly allowance.
--- API key: the company credit card number written on a sticky note.
--- Spending limit: the credit limit you ask the bank to set, which you must turn on yourself.
Why can a stolen AI API key cost so much?
A stolen key can be used by machines, around the clock, at full speed. Attackers run expensive models in bulk, often to resell access or to collect answers for training their own systems. Because the provider sees a valid key, nothing looks wrong until the invoice arrives.
Three recent cases show the scale:
--- US$82,314 in 48 hours: the startup above normally spent about US$180 a month. The key was compromised on 11 and 12 February 2026 and used heavily on Gemini image and text models.
--- US$600,000 over three weeks: the AI research group METR disclosed in August that attackers took a key from an exposed test app in March and consumed US$600,000 of credits, as reported by ITPro. Nobody noticed for weeks, and at the time there was no way to put a spending limit on that key.
--- US$168 to US$1,700 per user: after the coding tool OpenCode disclosed on 17 October 2026 that a retired system holding customers' OpenAI, Anthropic and Google keys had been breached, users reported unexpected charges, according to an incident record compiled by OrcaRouter.
For a Hong Kong SME, US$82,000 is roughly HK$640,000. That is more than a year's salary for two full-time administrative staff, lost in a weekend.
How do AI API keys get leaked?
Most keys leak through ordinary mistakes, not genius hackers. They get pasted into code, chat messages and shared documents, or they sit inside a third-party tool that is itself breached. Security firm GitGuardian found 1,275,105 leaked AI-service secrets on public GitHub in 2025, up 81% in a year.
GitGuardian's State of Secrets Sprawl 2026 report counted about 28.65 million new hardcoded secrets in public code during 2025. It also found that 64% of secrets first spotted in 2022 were still valid in early 2026, which means many leaked keys are never cancelled.
The common routes are:
--- Written into code or websites: a freelancer builds a chatbot and leaves the key inside the page, where anyone can read it.
--- Poisoned software updates: on 21 October 2026, a hacked release of LiteLLM, a popular tool that connects apps to many AI models, was live for under two hours and stole cloud credentials and AI keys from machines that installed it, according to Help Net Security.
--- A vendor that stores your key: the same day, hosting platform Railway told customers who signed up before 21 October to rotate stored keys after attackers decrypted some saved settings. OpenCode's breach worked the same way.
--- Quick test apps: METR's key sat inside an app built quickly with AI help, whose login check silently failed.
--- Copy and paste: keys sent over WhatsApp, email or pasted into an AI chat to "help fix the code".
Where does a Hong Kong SME have AI API keys without knowing it?
Many owners have never created a key themselves, yet their business runs on several. Any tool that "connects to ChatGPT" for you, from a website chatbot to a WhatsApp auto-reply or an automation workflow, probably holds a key linked to someone's card. The question is whose card, and who can see the key.
Consider four common setups:
The website chatbot. A trading company in Kwun Tong paid a freelancer to add an AI chat box to its website. The freelancer created an OpenAI account with the company's credit card and pasted the key into the site. The freelancer has since moved on, and nobody in the company knows the account password.
The automation workflow. A beauty salon uses an automation tool to draft replies to booking enquiries. The workflow holds an Anthropic key. The staff member who set it up left in June, and the key still works.
The vendor platform. A tutoring centre's AI assistant runs on a software platform that asks customers to "bring your own key". The key is now stored on that vendor's servers, exactly as in the OpenCode case.
The side project. A marketing assistant built a small tool to write product descriptions, using a personal key paid by the company. The code sits in a public online folder.
None of these businesses has done anything unusual. Each one has a credit card number taped to a wall it cannot see.
What do people get wrong about AI API keys?
The biggest mistake is treating a key as the developer's problem. The account, the bill and the customer data behind the key all belong to the business. Four beliefs cause most of the damage, and each one is easy to correct once you see it.
Myth 1: "The provider will refund fraud." Sometimes it does, and sometimes it does not. Two days after the OpenCode breach, no reimbursement policy had been published for affected users, and the startup with the US$82,314 Gemini bill reported that Google would not review the charge before payment was due.
Myth 2: "We would notice strange usage." METR is an AI research group that watches usage closely, and it still missed three weeks of misuse because the traffic blended in with its normal heavy use.
Myth 3: "Updating the software fixes a leak." It does not. Once a key has been exposed, the only fix is to cancel it and issue a new one. LiteLLM's own advice after the October incident was to treat every reachable credential as compromised.
Myth 4: "A small business is not a target." Attackers use automated scanners that look for any valid key. They do not care whose card is behind it.
How do you protect your AI API keys?
Protecting AI API keys takes five habits, not a security team. List every key, set a spending limit on each account, give each tool its own key, cancel keys when people or vendors leave, and never share keys in chats or code. Most of this takes one afternoon and a check-up every quarter.
--- Step 1, make a key list. Write down every tool that uses AI, which provider it calls, whose card pays and who can log in to the account. Ask each vendor directly: "Do you store an AI key for us?"
--- Step 2, set limits and alerts. Most AI providers let you set a monthly budget or spending limit in the billing settings. Check whether it is a hard stop or only an email alert, and set both where possible.
--- Step 3, one key per tool. Give the chatbot, the automation tool and the reporting script separate keys. If one leaks, you cancel one key, not your whole business.
--- Step 4, rotate and revoke. Replace keys on a fixed schedule, and immediately when a staff member, freelancer or vendor leaves. Make sure the account login belongs to a company email, not a person's.
--- Step 5, never paste keys. Keys do not belong in WhatsApp, email, shared spreadsheets, website code or AI chats. If you see one, treat it as leaked.
When news breaks of a tool you use being compromised, act the same day: cancel the key, create a new one, and check the last month of usage for anything unfamiliar.
AI API key FAQ
Is an API key the same as my ChatGPT password?
No. Your password logs a person into a chat app with a fixed plan. An API key lets software use the AI model directly and bills usage to the account, often without any upper limit.
How do I know if my key has leaked?
Look for usage spikes, requests at odd hours or models you never use in the provider's usage dashboard. If a tool you use reports a breach, assume the key leaked and replace it.
Does a leaked key expose customer data?
It can. Depending on the provider and settings, a key may give access to stored files, assistants or conversation history linked to your account, in addition to running up charges.
Should I stop using tools that need my key?
No. Bring-your-own-key tools are common and often cheaper. Just ask how the vendor stores your key, set a spending limit, and give that tool its own key so you can cancel it alone.
Why does an AI API key deserve the same care as a credit card?
Because it spends your money, with your name on the bill, whenever anyone presents it. The businesses that avoided October's leaks were not the most technical. They knew where their keys were, capped what each could spend, and replaced them the moment a vendor raised the alarm.
AI keys will keep multiplying as more of your tools quietly connect to AI. The good news is that the protection is mostly about ownership and habits, the same discipline you already apply to cheques, petty cash and the shop keys. For the wider picture on controlling AI spending, read our guides on AI FinOps and AI guardrails.
Treat the key like the company card it really is, and AI stays a tool that saves you money instead of one that quietly spends it. We understand AI. UD stands with you.
Reviewed by the UD AI team.
Not sure how many AI tools your business already runs, or who holds the keys behind them? Take the free AI Ready Check and we will walk you through it step by step, from listing the AI tools in your business to a simple plan for keeping their keys, accounts and spending under control.