API Key & Secret Management

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand API Key & Secret Management, no intimidation required
Apply this concept right away in real-world scenarios
Learn to avoid security risks for yourself and others

Let's think about it this way for a second

If you hardcode a secret into your code and accidentally commit it to a public GitHub repo, bots that constantly scan public repos can pick it up and steal it within minutes. Using environment variables (a .env file added to .gitignore) or a secret manager service (AWS Secrets Manager, HashiCorp Vault) lets you keep secrets separate from your code repository.

Let's connect this to a real-world scenario

Adding .env to .gitignore prevents accidental commits, but sometimes people commit it before setting up .gitignore, leaving the secret sitting in the history — if that happens, you need to rotate the secret immediately; simply deleting it from git history isn't enough (for public repos it can still linger in caches or forks).

Never hardcode secrets into code
Add the .env file to .gitignore
Rotate a leaked secret immediately

Let's look at it together

bash

# .gitignore
.env

# .env (never committed)
DATABASE_PASSWORD=xxxx
API_KEY=sk-xxxx

# code (reads from environment, not hardcoded)
const apiKey = process.env.API_KEY;

You should see

Be able to explain the pattern of separating secrets from code using environment variables.

Try it in 5 minutes

Check whether .env is listed in your project's (if you have one) .gitignore. If it isn't, add it right now.

A quick word of caution

If a secret was ever committed to a public repo — even once — don't assume 'deleting it' is enough. Rotate it immediately (issue a new key, revoke the old one) and treat that secret as leaked.

Easy traps

Thinking adding a secret to .gitignore is 'job done' — it can still remain in your existing commit history
After a secret leak, thinking just adding it to .gitignore is enough without rotating it

Now try it yourself

Check whether .env is listed in your project's (if you have one) .gitignore. If it isn't, add it right now.

You'll know it worked when: Be able to explain the pattern of separating secrets from code using environment variables.