# `Error: Secret API key must not use the NEXT_PUBLIC_ prefix`

**Where it appears:** Browser or terminal

**What it means:** A secret key was named with `NEXT_PUBLIC_`, which sends its value to every visitor's browser.

## Likely causes

- Adding `NEXT_PUBLIC_` to an API key or auth secret so client code could read it.
- Calling an AI provider or database from a `'use client'` component instead of the server.

## Message for your agent

```text
A secret variable used `NEXT_PUBLIC_`. Move the code that uses it to the server, rename the variable without `NEXT_PUBLIC_`, and I will revoke and replace the exposed key.
```

**Prevention:** Golden rule: nothing secret ever starts with `NEXT_PUBLIC_`. Keep keys server-only.

---
Source: [Agentic Makers](https://agenticmakers.app/en/help/errors/secret-exposed-with-next-public-prefix) · License: CC BY 4.0