Keeping API Keys Safe

Secrets

Part of: Your First API Call

Lesson 3 told you the one rule: never paste your key into your code. This lesson is the full discipline behind that rule, where secrets actually live, how to stop them ever reaching GitHub, and what to do the moment one leaks. Companies have lost serious money to a single committed key. The habits here are cheap insurance. What it is A secret is any value that grants access and must never be public: API keys, database passwords, tokens. The professional way to handle one is an environment variable : a name-value pair stored in your operating system's environment, outside your source files. Your code reads the value at runtime by name; the value itself never appears in the code. For convenience during development, secrets often live in a .env file : a tiny text file of NAME=value lines that a loader reads into environment variables when your program starts. How it works The whole pattern is three moves. First, put the secret in a .env file. Second, the move everyone forgets, add .env to .gitignore so Git refuses to track it: Third, read it in code by name, never by value: Notice what's shareable: the code (safe, just reads a name), a committed .env.example listing the names with bla

Challenge: Secret Leak Scanner