Secure your OpenAI API key (and your Claude and Gemini keys): a checklist

The OpenCode Console breach put saved OpenAI, Anthropic and Google keys at risk. What actually limits the damage when a key leaks: one key per tool, expiring keys, hard spend caps, server-only calls and a first-hour plan.