How to Securely Store and Use API Keys in Laravel in 2026

In 2026, almost every Laravel project integrates 3–10 external APIs: OpenAI, Stripe, Telegram, AWS S3, Resend, Brevo, and so on. Yet most key leaks happen not because of sophisticated attacks , but due to silly mistakes: committing to git, logging them, sending them to the frontend, or calling env() in production after config:cache . Today we’ll walk through a battle-tested path — from “it just works” to “I sleep peacefully”. 1. Basic (but already correct) level — .env + config Never hard-code keys in your source: // ❌ Bad $openai = new OpenAI ( 'sk-123...' ); // ✅ Good # .env OPENAI_API_KEY = sk -... STRIPE_SECRET_KEY = sk_live_ ... // config/services.php return [ 'openai' => [ 'api_key' => env ( 'OPENAI_API_KEY' ), 'organization' => env ( 'OPENAI_ORG' ), ], 'stripe' => [ 'key' => env ( 'STRIPE_KEY' ), 'secret' => env ( 'STRIPE_SECRET_KEY' ), ], ]; Usage: $key = config ( 'services.openai.api_key' ); // or with type safety (Laravel 11+) $key = Config :: string ( 'services.openai.api_ke