Keys

A key is the part of the request that says who sent it. Whoever holds it is you. This page is where it lives, and what to do the minute it escapes.

After the lessonGoes with Request Builder step 9

The rule

A key lives in exactly one place: the backend, or an environment variable on your own machine. Never in page code, never in a chat, never in a screenshot. If it escapes, revoke it first and ask questions later.

01What a Key Is

In Round Three the machine replied 401 Who are you? Key needed until the request carried a key. When the key was posted in the public chat, it replied 401 Key leaked. Revoked. Those two replies are the whole idea.

The machine cannot see you. It sees text. A key is a long, unguessable piece of text that the machine issued to you, and only to you. When a request carries it, the machine treats the request as yours: your account, your limits, your bill.

It travels on the envelope, not inside the letter, as a header:

KeyAuthorization: Bearer gsk_••••••••••••••••

Bearer means exactly what it says: whoever bears this key gets in. The machine does not check who is holding it. That is why a leaked key is as good as a stolen login.

02Where a Key Lives

In step 9 of the Request Builder you open DevTools and see your own key in plain text. Anything a web page sends, any visitor can read. So the key cannot live in the page.

UIholds the Groq key

→

Groqaccepts whoever bears the key

Every visitoropens the Network tab and copies it

Wrong. The key ships to everyone who loads the page.

UIsends the workflow. No key to Groq.

→

Aarav's backendholds the Groq key in an environment variable

→

Groqsees the backend's request

Right. The visitor's browser never sees the Groq key. This backend is what you build in the next lesson, Building APIs and the backend.

Where it goes, by situation

Situation	Where the key lives
Trying a request today	The Request Builder. It holds the key in memory only, never saves it, and forgets it when you reload.
A command in your terminal	An environment variable, such as `GROQ_API_KEY`. The command reads `$GROQ_API_KEY`, so the key never appears in the command itself. See the kit.
Your Python backend	An environment variable set in your terminal. The code reads `os.environ["GROQ_API_KEY"]`.

Never here

Page codeAnything the browser loads, anyone can read.

A forum or group chatNot in a help post, not in a DM. Mask it: gsk_••••.

An AI chatNot even to ask why it fails. Paste the error, not the key.

A screenshotCrop or blur before you post.

03The Minute One Leaks

You will leak a key at some point. Everyone does. What matters is the next five minutes.

Revoke it. Go to console.groq.com/keys and delete the leaked key. From that moment, every request carrying it gets 401, including the ones from whoever copied it.
Create a new one. Same page, Create API key. Copy it once; Groq will not show it again.
Update where it is used. Your environment variable, your .env file, your host's settings. Anything still using the old key now fails with 401, which is how you find what you missed.
Remove the leak. Delete the message or the screenshot. This is the last step, not the first: once a key has been seen, assume it was copied.

04Why Sharing a Key Shares Everything

Groq's free tier allows openai/gpt-oss-120b 30 requests a minute and 1,000 a day. Those limits belong to your account, not to the key. Creating five keys does not give you five times the limit. Giving your key to five friends means all six of you draw from one limit.

When the limit runs out, the machine replies 429 Too many requests, with a retry-after header saying how many seconds to wait. If a hundred people share one key, that happens within seconds. That is why everyone makes their own Groq account.

Past the free tier, you pay per token. A shared key is a shared bill.

05Check Yourself

I have my own Groq key, from my own accountNamed so you know where it is used, such as fde-apis.
My key is not in any chat, screenshot, page or repositorySearch your chat history for gsk_ if unsure.
I know where the revoke button isconsole.groq.com/keys. Find it now, before you need it.
I can say why the UI must not hold the keyAnything a page sends, any visitor can read in the Network tab.
I mask keys in help postsThe status code and the error text are what helpers need. Never the key.

Done

0 / 5

Whoever bears the key gets in.Companion pages: reading the Network tab · kit · troubleshooting