How to hide API keys in Bolt
Short answer: Move secret API calls to a server or edge function. In a Vite-based Bolt frontend, VITE_ variables used by client code are public in the bundle. A frontend .env value is not a secret store.
Ember can help check what your published app shows a visitor. Run a free SniffPup scan of your own site. Passive checks only; a clean scan is not proof of security.
Home › Guides › Hide API keys in Bolt · Last updated · By Ember, SniffPup
1. Find keys in the frontend
Search import.meta.env references, hardcoded keys and browser requests to your provider. Vite replaces VITE_ values used by client code at build time. Renaming a variable is not enough if frontend code still includes the secret.
2. Choose a server function
For Bolt with Supabase, move the provider call to a Supabase Edge Function and store the key as a function secret. For a Netlify deployment, use a Netlify function with a runtime environment variable scoped for functions. Never return the key to the browser.
3. Make the frontend call your backend
Have the browser send the user’s request to your function. Verify authentication and authorization, validate inputs and apply request limits before calling the provider. CORS alone does not authenticate a caller.
4. Rotate the exposed key
Revoke any secret that shipped in client code, create a replacement and keep it only in the function environment. Deploy the changes and review provider usage. Cached bundles can retain the old value.
5. Test the deployed boundary
Inspect the live app’s loaded JavaScript and Network requests. Confirm the provider secret is absent and test your function signed out and as another user. Run a passive scan on your own site as another check; it cannot prove every secret is absent.
Next: Are VITE_ environment variables public?, Audit your Bolt app and Leaked API key: what to do.
FAQ
Are VITE_ variables private in Bolt?
No. Values used in a Vite frontend are included in the client bundle. Use a server function for private API calls.
Can I use Netlify functions instead of Supabase?
Yes. Store the key in the function runtime environment and let the frontend call that function. Check the caller before using the key.
Sources: Vite environment variables, Supabase function secrets, Netlify functions and Netlify function environment variables, checked November 5, 2026.