An API key was pasted into the Lovable chat

Symptom

You pasted a provider key into chat so Lovable could wire up the feature. The key is now in the transcript, and maybe in client code.

Root cause

Lovable's security overview says frontend code runs in the browser, so API keys cannot be stored safely there. Lovable says it detects API keys pasted into project chat and guides you to store them in Secrets, and to call the provider from server-side code. The recommended prompt describes the integration and does not include the key. The best-practices page shows a hardcoded key in the frontend as the wrong pattern and says a secret in frontend code should be considered compromised.

Do not ask me to paste the key again.

1. Search this project for hardcoded provider keys in frontend files and remove them.
2. Read the key from Secrets inside a server function, Edge Function, or API route.
3. Call that server code from the UI. The response must not include the key.
4. I will rotate the key at the provider and store the new value in Secrets myself.

Tell me the file you will change and the secret name you will read.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. Search your own Lovable project for a key prefix you use, such as sk_live or sk-.
2. Confirm the call site is server code and the browser network response does not echo the key.
3. Rotate the key if it was ever pasted into chat, then update Secrets.

Sources

• Lovable: Security overview (API keys)
• Lovable: Security best practices