Authentication, Billing, and API Key Management
Essential before publishing an LLM app is authentication, billing, and key management. Neglect this and you get cost blowups or information leaks.
API Key Management (Most Important)
- Hold keys in server-side environment variables / a secret manager
- Never put them in the client or repository
- Separate keys by purpose and rotate immediately on leak
- Set usage caps and alerts (prevent cost runaway)
Authentication
- Always identify "who called" via user authentication
- Don't let unauthenticated requests hit expensive models
- Rate limiting and abuse detection (linked with the rate-limiting chapter)
Billing Design
- Bake usage-based cost (token billing) into pricing
- Per-user usage measurement and quotas
- Countermeasures against free-tier abuse
Key Point
The risk of an LLM app is less "it doesn't run" and more "it runs too much, causing cost/leak incidents." Locking down keys, auth, and caps first is the iron rule.
