The hunt for frontier model API keys is real, and it's getting worse. If you can avoid putting long-lived keys in your projects, do. Short expirations and on-platform gateways help a lot. It's one reason we went with 5 minute keys minted on the fly for the @convex AI gateway. But the general principle applies anywhere.