The hunt for frontier model API keys is real, and it's getting worse.
If you can avoid putting long-lived keys in your projects, do. Short expirations and on-platform gateways help a lot.
It's one reason we went with 5 minute keys minted on the fly for the
@convex AI gateway. But the general principle applies anywhere.