Where Your LLM API Key Lives Determines How Much Damage a Breach Can Cause

Most AI applications authenticate requests to LLM providers like OpenAI or Anthropic by loading an API key directly into the application's own process via an environment variable. This means every dependency running in that process has access to the same credential, so a single compromised package can silently steal the key without breaking into any external infrastructure. An alternative architecture routes requests through a separate gateway or proxy, which holds the provider key itself while the application only carries a limited scoped token. If the application is compromised in this setup, attackers gain access only to that restricted token rather than the full provider credential. While neither approach eliminates supply-chain risk entirely, the proxy model significantly reduces the potential blast radius of a dependency compromise.