A leaked language model API key is not like a leaked database credential. Nobody has to breach anything: they simply spend your money, at scale, until someone notices the invoice. The fixes are well understood and routinely skipped.
1. Never let a key reach the client
Every model call goes to your backend first. Your server authenticates the user, applies rate limits, then makes the upstream call with the key. A key in a mobile app binary or a browser bundle is a published key, whatever your obfuscation does. For browser-based realtime voice, use ephemeral tokens minted server-side and scoped to a single short session. See OpenAI Realtime API development.
2. Scope keys per environment
3. Hard-cap spending at the provider
Set a budget limit in the provider console, not only in your own code. Application-level limits fail with the application. A provider-level cap is the backstop that turns a catastrophe into an incident.
4. Rate limit per user, not only globally
A global limit protects your bill; a per-user limit protects your product from one abusive account consuming the whole allowance. You want both, and you want the per-user limit tied to an authenticated identity rather than an IP address.
5. Monitor for the shape of abuse
6. Treat prompt injection as an access-control problem
If your agent can call tools, a successful injection is a privilege escalation. Scope what each tool can do, require confirmation for anything destructive or costly, and never let content retrieved from a document or web page decide which tool runs.