Don’t store secrets in prompts, use environment variables or vaults, authenticate with secret tokens/custom headers/OAuth2 on your server, and keep all API keys server-side only..