Ask an AI to add an API call to your React Native app and it will often do this:

const response = await fetch ( 'https://api.openai.com/v1/chat/completions' , { headers : { Authorization : 'Bearer sk-proj-abc123yourrealkeyhere' , } , } ) ;

Enter fullscreen mode

Exit fullscreen mode

The key is in the source code. It ships in your APK. Anyone who decompiles your app — and plenty of tools do this in seconds — can read it, use it, and run up your bill.

Here's the right way to handle API keys in React Native, and the prompt that gets AI to do it correctly from the start.

Why .env alone isn't enough

The usual advice is "put it in .env ". That's correct, but it only solves half the problem.

OPENAI_API_KEY = sk - proj - abc123

Enter fullscreen mode

Exit fullscreen mode

With react-native-dotenv or expo-constants , your app reads the key at build time. It's out of your source code — good. But it's still bundled into the JavaScript that ships with your app.…