Which key

Keep keys on a server. Never put them in a browser, a mobile app or a public repository. A revoked or reset key stops working at once.