---
title: "Keep secret keys on the server · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/server-side-keys
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep secret keys on the server

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Apps built with AI builders](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders)
- Rule: Never ship a secret key in code that runs in the browser. That covers database secret or service role keys, payment secrets and AI provider keys.
- How: Builders sometimes place keys in front-end code to make a feature work. Move every call that needs a secret into a server function or edge function. Rotate any key that has ever reached the browser. The general rule is [keep secrets out of the browser](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-browser).
- Check: Download every script the live app loads and search for key patterns, such as `sb_secret_`, `sk_live_` and `sk-`. Decode each token that starts with `eyJ` and confirm none has the role `service_role`. Only public keys are found.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/server-side-keys`.

- Previous: [Turn on row-level security for every table](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/row-level-security)
- Next: [Check every sign-in and permission flow](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/check-auth-flows)
- [Apps built with AI builders](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders)