Storing API keys in your application's source code is a common pitfall. Instead, use environment variables or a secrets management tool. Check if your application can still access the API after moving the key. Did the service continue to function without changes to the code? How are you ensuring that only authorized personnel can modify these secrets?