How long does it take to store your AI provider's API key properly? About a minute. Some Drupal tasks eat an afternoon. This isn't one of them. It's a small fix with a real payoff, and I'd argue it's one of the first things to get right when you add AI to a site. That's why it works as a 60-second short. You can do it today.
The AI module ecosystem for Drupal has gotten big. One recent roundup curated 63 Drupal AI projects and compared their uses, releases, adoption and security advisory status[7]. Those projects build on the core AI module, which connects your site to outside providers. Every provider needs a credential. Provider usage is billed. So where that credential lives matters.
We're going to walk through why the Key module should hold your AI API keys, how it fits with the core AI module, and what to check before you start.
Why Key Storage Matters More Once AI Arrives
Drupal's AI stack starts with the AI (Artificial Intelligence) project on Drupal.org[1]. Vardot's 2026 contributor's guide rates the foundation and editorial modules (AI Core, AI CKEditor, AI Search, Guardrails and Observability) as production-ready[9].
Production use means production risk. If a provider key gets exposed, someone else could run up charges on your account. Sounds unlikely? Maybe. But teams already worry about API costs when nothing has gone wrong. DrupalForge wrote a whole 2026 guide about teaching Drupal AI without burning through API budgets, with tactics like running a local Gemini Nano model at $0[6]. If people are counting pennies on legitimate usage, a leaked key is the last thing you need.
What the Key Module Does
The Key project on Drupal.org manages sensitive keys, like API and encryption keys, and lets administrators decide how and where those keys are stored[2]. Instead of pasting a raw API key into each module's settings form, you create a named key and point modules at it.
For site builders, that pays off in three ways:
- Rotation. When you rotate a provider key, you update the key entity. No hunting through settings forms.
- Storage. You choose where the secret lives. Key's own docs mark database storage as development only, and recommend a file outside the webroot, an environment variable, or an external key management service[2]. Pick one of those and the key is much less likely to end up in a repository.
- Reuse. One named key can be referenced from more than one place, so you're not copying the same secret around.
How Key Fits Into the Drupal AI Workflow
Key isn't a side project here. It's already part of how the AI module gets set up. In the Key project's issue queue, marcus_johansson opened "Create custom recipe action for Key module"[10], noting that the AI module relies heavily on Key for API keys and other secrets. The proposal is a recipe action that creates the key entity from an input value and links it to the right configuration. That way, key setup can happen while a recipe is applied.
The learning material starts in the same spot. The Drupal AI Initiative's webinar recap walks through installing the AI module and its basic features[12]. The Drupal AI Learners Club session on June 10, 2026 was called "Getting Ready to do Cool Stuff with AI in Drupal!"[4]. For me, getting ready means credentials set up properly before anything gets built on top of them.
The 60-Second Setup
Four steps:
- Install the Key module alongside the AI module[1][2].
- Create a new key for your AI provider. Give it a name you'll recognize six months from now.
- Choose where the key value lives. A file outside the webroot, an environment variable or an external service all keep it out of the database and out of exported config.
- In your AI provider's settings, select that key instead of pasting in the raw value.
That's it. Features you add later, like editor suggestions or search, can use that same stored credential. Set it once. Reuse it.
Once Your Keys Are Secure, Add Features
With credentials handled, you can start building. Search Drupal.org for AI content suggestions and, as Vardot points out, you'll find three modules, not one. AI CKEditor suggests text inside the editor. AI Content Suggestions adds suggestion buttons to fields. AI Content Review scores each page against your written standard before it publishes[5].
You'll also run into Search API AI[3]. Its project page says it has been moved into the AI module as the ai_search submodule. Then there's Drupal AI code generation[8], which is explicitly development-only. Not for production. Period. Pantheon's learning center covers how Drupal AI modules can streamline editorial workflows[11]. Before you install anything, check The DropTimes' maturity tracker for each project's release and security advisory status[7]. Vardot's readiness tiers help too: multi-step Automators and the Context Control Center are rated pilot-ready, not production-ready[9].
Spend One Minute Now to Prevent Problems Later
Your AI features lean on the keys behind them. The Key module gives your provider credentials a managed home. It lets you keep secrets out of exported configuration, as long as you pick the right storage. And it lines up with the recipe-based setup the AI module's developers are working toward[2][10].
Open your site. Find any AI provider key pasted straight into a settings form. Move it into the Key module. Then subscribe for more 60-second Drupal AI setup tips, and send this to whoever last touched your AI settings page.
- AI (Artificial Intelligence) | Drupal.org
- Key | Drupal.org
- Search API AI | Drupal.org
- 2026-06-10 — Getting Ready to do Cool Stuff with AI in Drupal!
- AI Content Suggestions in Drupal: Which Module Goes Where
- Teaching Drupal AI Without Burning API Budgets: 2026 Guide
- Drupal AI Modules by Use Case: A Maturity Tracker
- Drupal AI code generation
- Drupal AI Modules in 2026: A Contributor's Guide - Vardot
- Create custom recipe action for Key module [#3495119] - Drupal
- Streamlining Workflows with Drupal AI Modules - Pantheon.io
- Installing the AI Module and Basic Features — Webinar Recap
Secure your Drupal AI provider API keys in about 60 seconds with the Key module. Instead of pasting credentials into settings forms, store them in an environment variable, a file outside the webroot, or an external key management service. This helps prevent exposed keys, unexpected API charges, and secrets leaking into exported configuration. Create one named key, connect it to your Drupal AI provider, and reuse it across features such as AI CKEditor, content suggestions, and AI Search. It also simplifies credential rotation and supports safer, production-ready Drupal AI workflows.