Based on the real €54,000 Gemini billing incident (April 2026): how to lock down your Google, OpenAI, and Anthropic API keys before someone else uses them.
AI API security checklist covering Google Cloud, OpenAI, and Anthropic — based on the real €54,000 billing spike incident from April 2026.
In April 2026, a developer left a Firebase browser API key unrestricted. Someone found it, used it for Gemini API calls, and ran up €54,000 in charges in 13 hours. Three free settings would have prevented it entirely.
You’ll get:
Anyone using AI APIs directly — or anyone who has had a developer, contractor, or employee set up AI integrations for their business. You don’t need to be technical to run this checklist. It’s structured as checkboxes with clear steps.
This is also relevant if you’ve ever given a third-party AI tool access to your own API key — a practice that’s increasingly common and carries real risk.
Run through this checklist once, set up billing alerts, and you’re protected against this entire class of problem. The three key settings — API restrictions, billing caps, and usage monitoring — are all free and take under five minutes each to configure.