CCDV-F practice › Security and Safety · Question 27 of 92
Security and Safety
Where should a production application's Claude API key actually live?
Show answer and explanation
Answer: C — Server-side, in an environment variable or secret manager, with routine rotation
API keys are credentials, not content — they belong server-side in a secret manager or environment variable, never in client-side code or anywhere the model itself could read or leak them, and should be rotated routinely.
Keep going
More Security and Safety questions
- A retrieved document contains embedded text targeting the model, while a user in chat…
- An agent authenticates successfully on every request while being manipulated into…
- A team argues broad agent credentials are acceptable because the agent is internal-only…
- An agent processes a scraped webpage that contains hidden text instructing it to email…
- An autonomous agent runs with the full API credentials of the engineer who launched it…