Secure AI chat: protect API keys and client information

An AI chat box can look simple while connecting to customer accounts, project files and paid model APIs. Treat it like any other production integration: limit what it can see, keep credentials on the server and plan for misuse.

Keep provider credentials off the client

Store API keys in your hosting provider’s encrypted secret manager. Call the model from a server route, validate the request, cap input and output, and return only the response the user needs. Never place private keys in a NEXT_PUBLIC_ variable, bundle, browser local storage or chat transcript. If a key lands in a public repository, issue, screenshot or chat, revoke it and create a replacement.

Send only the context needed

Do not attach every profile field, invoice, message and file to every prompt. First decide exactly what the feature needs. A public product guide usually needs only a short, approved description of your services. A project assistant should check authorization before it retrieves project data and should disclose only fields needed to answer that question. Avoid saving conversation content unless you have a stated purpose, retention period and privacy notice.

Assume prompts can be manipulated

Prompt instructions are not an access-control system. A user may ask the model to ignore prior instructions or reveal hidden context; a retrieved document may contain instructions intended to manipulate the assistant. Enforce permissions in code, keep tools narrowly scoped, and require a person to approve actions such as changing a project, issuing an invoice or sending a commitment. Test both normal questions and adversarial inputs before launch.

Put limits around the feature

• Require login for account-specific help; use request limits for public chat.
• Cap input length, output tokens and per-user daily requests.
• Use provider fallback only for temporary errors or exhausted quotas.
• Do not let generated text approve payments, alter access or promise an estimate.
• Monitor aggregate usage and error counts without logging sensitive prompts.

OWASP’s GenAI security work tracks risks such as prompt injection and sensitive information disclosure. Use it as a starting checklist, then test the exact data flow and permissions in your application.