$0 monthly fees won't fix a leaked API key

01 / Committed a key? Stop requests before cleaning git

A leaked API key can turn a cheap request into somebody else's spending spree. CheapRelay has $0 in monthly fees and no subscription, but usage still costs money. The first fix is access control, not a prettier commit history.

If a real key entered a commit, treat it as exposed. Revoke it immediately, issue a replacement, and update the applications that need it. Do not wait for proof of abuse. A private repository reduces visibility; it does not make a committed credential safe.

02 / “I deleted the key. Why is it still a problem?”

Git preserves earlier versions. Deleting a credential in a new commit leaves the old value available in history. Copies may also exist in clones, forks, pull requests, CI logs, and artifacts. Deleting a branch does not reliably erase those copies.

Use this order:

• ■ Revoke the exposed key and pause affected jobs if necessary.
• ■ Check available usage records for unexpected requests and spending.
• ■ Replace the credential in your deployment's secret store.
• ■ Remove the secret from tracked files and assess history cleanup.

Rotation blocks future use of that credential. History rewriting reduces its continued distribution; it cannot recall copies already downloaded. Coordinate any rewrite with collaborators and follow your repository host's sensitive-data removal instructions.

03 / “I added .env to .gitignore. Why is git tracking it?”

Ignore rules do not untrack files already in the index. For a tracked .env file, run git rm --cached -- .env, then commit that removal together with the ignore rule. This keeps your working copy while removing the file from the next committed snapshot. It does not erase earlier commits.

Ignore the local secret files you actually use. A common pattern is .env and .env.*, followed by !.env.example so the example remains trackable. Check the result with git check-ignore -v --no-index .env, and inspect git diff --cached before committing.

Commit an .env.example containing variable names and blank values, such as OPENAI_API_KEY= and OPENAI_BASE_URL=. Never seed it with a working “temporary” key.

04 / “Where should my application read the key instead?”

Use environment variables or your platform's secret manager. A local .env file is only a convenience: your runtime needs a loader, and the file still needs protection from backups, screenshots, and accidental uploads. Production and CI credentials belong in their respective secret stores.

CheapRelay uses https://api.cheapapirelay.com as its API base, with OpenAI-compatible routes under /v1 and Gemini-native routes under /v1beta. For an OpenAI SDK, configure the base URL as https://api.cheapapirelay.com/v1 and supply the key separately. The endpoint is public configuration; the credential is not.

Never embed a relay key in browser JavaScript or a distributed mobile app. Put authenticated requests behind your server, with authorization and usage controls.

05 / “Can my coding agent fix this without reading secrets?”

Usually. Give it variable names, a sanitized error, and the relevant configuration structure. Do not paste the credential or ask it to dump the entire environment. Keep secret files out of agent context using the tool's supported exclusions, but do not mistake exclusions for a security boundary.

For authentication debugging, check whether the variable exists without printing its value. Then verify the endpoint and process environment. Run one small test request with a low output limit instead of repeatedly sending your whole conversation. CheapRelay bills real tokens, including cache reads and writes; repeated context is not automatically free.

06 / “Which checks prevent the next expensive mistake?”

Use a local pre-commit secret scanner for fast feedback and CI scanning as a second layer. Enable repository push protection where available. Scanners can miss unfamiliar key formats, so review staged changes yourself.

Keep separate credentials for separate environments where supported, remove unused keys, and configure spending controls or alerts wherever your provider offers them. Sign up for CheapRelay if pay-as-you-go access fits your workflow, then store that new key before making your first request. Cheap tokens are useful; paying for unauthorized requests is not.