Use xlwings Lite environment variables with Local scope. Never type a key into a cell. A key in a cell goes with every copy of the file you send.
How to set one. In xlwings Lite, open Settings > Environment Variables. Add the name the tool expects, for example GEMINI_API_KEY or OPENROUTER_API_KEY, set the scope to Local, then restart xlwings Lite. Your Python code reads it with os.getenv("GEMINI_API_KEY") and should stop with a clear error if it is missing.
The two scopes. Local is kept in your browser storage, works across all your workbooks and is not saved in the file. Workbook scope is saved inside the file, so keep it for settings only. If both hold the same name, Local wins.
Two cautions. A Local key is deleted when the Office cache is cleared, so keep your own copy of it somewhere safe. And any workbook you trust can read your Local keys, so trust workbooks only from sources you know.
TigZig's xlwings Lite tools work this way. The web scraper needs one free Gemini key (https://www.tigzig.com/web-scraper). AI Workflows takes a Gemini or an OpenRouter key (https://www.tigzig.com/xlwings-llm-api). The Technical Analysis workbook needs no key at all: https://www.tigzig.com/agents-faq/can-i-get-an-ai-technical-analysis-report-in-excel-without-an-api-key.
For your AI coder: the same rules are in section 13 of the AI Coder Instructions file. How to learn xlwings Lite with AI: https://www.tigzig.com/agents-faq/how-to-learn-python-in-excel-xlwings.
Building something like this? How I work covers the rates, the availability and what I take on.