DailyRNG
Login
Basic

Keeping your secret safe

API keys are passwords. If you commit one to a repo, anyone can spend your money and abuse your service. Learn to keep secrets in environment variables instead of your code.

What you will see

Git ignores: .env Git ignores: node_modules

About 2 min of reading

Quick check

Before this new lesson, one small question about the lesson you just finished. Recall it, do not look it up.

Try It

API keys are passwords. I read a secret from the environment instead of writing it in code, load values from a .env file, and show that git ignores the file so the key never reaches a repo.

1

A secret comes from the environment, not from a line of code where anyone can read it. I set one in the environment and print a short masked version to prove the code never stores the real value.

import os os.environ["API_KEY"] = "sk-SECRET-123" api_key = os.environ["API_KEY"] print(f"Key loaded: {api_key[:5]}...")

Before you run it, say out loud what it will print. Then open the answer.

What it prints
Key loaded: sk-SE...
Never write the key as a literal string. A leaked key costs money and can be abused, so treat it like a password.
2

Locally, secrets live in a .env file that a small library reads into the environment. I load the values and print one to show the code reading from there.

env = {"API_KEY": "sk-abc123", "MODEL": "gpt-4o-mini"} print(env["MODEL"])

Before you run it, say out loud what it will print. Then open the answer.

What it prints
gpt-4o-mini
The .env file is read at startup so the values fill the environment before your code reads them.
3

Git ignores secrets so they never reach a public repo. I list the files that should be ignored and print each one to show what stays local.

def gitignore(): return ".env", "node_modules" for path in gitignore(): print(f"Git ignores: {path}")

Before you run it, say out loud what it will print. Then open the answer.

What it prints
Git ignores: .env Git ignores: node_modules
Once a file reaches GitHub it is public. Adding .env to .gitignore is the single most important security habit in web development.

Put it in order

Before you write anything, put these lines back in the right order. Click a line to move it up one step. This support step is easier than writing code from scratch, and it is here to make the last example stick.

Data Flow

The env library reads .env into process.env at startup; code reads secrets from there so the values never touch the source files.
1 App starts up
↓
2 dotenv reads the .env file
↓
3 Values are placed into process.env
↓
4 Code reads process.env.API_KEY
↓
5 The key is used in the request
↓
6 The .env file stays out of git
Line by line

Read the first example one line at a time. A line that prints shows what appears on screen; the rest set things up quietly.

import os sets nothing on screen
os.environ["API_KEY"] = "sk-SECRET-123" sets nothing on screen
api_key = os.environ["API_KEY"] sets nothing on screen
print(f"Key loaded: {api_key[:5]}...") Key loaded: sk-SE...
Why this works
Why git ignores secrets

Once a file reaches GitHub, it is public. Anyone, including bots that scan for keys, can read it.

A .env file usually holds every secret your app needs. If one is committed, the damage is done even before you notice. That is why the rule is simple:

  • Put secrets in .env.
  • Add .env and node_modules to .gitignore.
  • Commit only code, never secrets.

This one habit has prevented real breaches. Make it automatic so you never have to remember.

Examples

Reading a secret

Never write your API key directly in code:

// BAD: key is visible to everyone
const apiKey = 'sk-abc123supersecret';

// GOOD: key comes from the environment
const apiKey = process.env.API_KEY;

process.env reads values set outside your program. Your code stays useful, but the secret never touches your files. If the code is ever shared, the key is still safe.

Watch out: a leaked key costs money and can be used to abuse a service. Treat it like a password, always.

The .env file

Locally, secrets live in a .env file that is git-ignored so it never reaches version control:

API_KEY=sk-your-real-key-here
MODEL=gpt-4o-mini

A small library reads this file and injects the values into process.env:

require('dotenv').config();
console.log(process.env.API_KEY);

A .gitignore file with env on its own line tells git to never track it:

.env

This is the single most important security habit in web development. It protects you the moment you write your first line of code.

Words this lesson uses

Each one is defined here on this site. Open the entry for the full definition and the other words it points at.

← Your first API call
Previous Lesson
Your first API call
Next Lesson
Understanding prompts
Understanding prompts →