Course B · Module B1 Production · Lesson 5 of 18

API Keys & Secrets

Connect services like Stripe and email — without ever leaking the keys to your kingdom.

~12 min · Have your hosting platform's dashboard open · Prereq: B4 Hosting & Infra

The moment you wire your app to Stripe, an email service, or an AI model, you're given a key — a long string of characters that says "this is me, let me in." That key is worth protecting as carefully as your bank login. One careless paste and a stranger can send emails from your domain, charge cards on your account, or run up thousands of dollars in AI API costs. Your single win today: by the end you'll know exactly where keys belong, where they never belong, and what to do the moment one leaks.

What an API key actually is

Think of a hotel key card. The hotel gave it to you to open your room. If you lose it, whoever finds it can walk into your room. If you hand a copy to a stranger, they can too. The card itself doesn't know it was lost — it just opens the door for whoever holds it.

An API key works the same way. It's a password your app presents to an external service to prove it's authorized. The service doesn't check whether it's really you — it just checks whether the key is valid. Whoever holds the key has your access.

API keyIdentifies your app to a service (Stripe, OpenAI, Mailgun). One key per service; often split into "test" and "live" variants.

Secret keyA higher-privilege key — usually means "full account access." Stripe calls this the secret key vs the publishable key. The secret one never leaves your server.

Webhook secretA shared password between you and a service (like Stripe) to verify that incoming webhook calls are really from them, not a fake.

The #1 rule: keys never go in code or GitHub

This is the rule that, when broken, causes the painful incidents. When your code is on GitHub — even a private repository — and a key is pasted directly into a file, it can be exposed. Public repos are read by automated bots that scan for keys within seconds of a push.

✗ Never do this

// config.js — DO NOT DO THIS
const stripeKey = "sk_live_51Abc..."
const openaiKey = "sk-proj-T4x..."

Keys pasted into source files end up in Git history — and Git history is forever. Deleting the line doesn't remove it from past commits.

✓ Do this instead

// config.js — safe
const stripeKey = process.env.STRIPE_SECRET_KEY
const openaiKey = process.env.OPENAI_API_KEY

The code references an environment variable by name. The actual key lives in your hosting platform's secret settings — never in the file.

Environment variables: where secrets actually live

An environment variable is a named value that lives in your server's configuration, separate from your code. Your app says "give me the value called STRIPE_SECRET_KEY" — and the server hands it back at runtime. The key itself never touches your codebase or your Git history.

How to set one up (Vercel example — other platforms are identical):

Go to your project in the Vercel dashboard.
Click Settings → Environment Variables.
Add a new variable: Name = STRIPE_SECRET_KEY, Value = your actual key.
Choose which environments it applies to (Production, Preview, Development).
Save. Redeploy. Your app now has the key at runtime without it ever touching a file.

For local development, create a file named .env.local in your project folder with the same variables. Then add .env.local to your .gitignore file so Git never tracks it. Your AI coding tool will usually set this up for you — just make sure the .gitignore line is actually there.

GitHub secret scanning watches every push to your repository and alerts you (or blocks the push) if it detects a known key pattern — Stripe keys, OpenAI keys, AWS credentials, and many more. It's a safety net, not a permission slip. Don't rely on it; rely on never putting keys in code in the first place.

If a key leaks: rotate immediately

Assume that any key that touches a file, a chat message, or a screenshot has leaked. The fix is fast and the cost of not doing it is high:

Key leak response — do this in order:

Rotate the key now. Go to the service's dashboard, revoke the old key, and generate a new one. The old key stops working immediately — any attacker holding it loses access.
Replace it in your environment variables. Update every hosting environment (production, preview, local) with the new key.
Check the service's logs. Stripe, OpenAI, and most providers show a usage log. Look for anything you didn't authorize in the period since the key was exposed.
Check your Git history. If the key ended up in a commit, the commit history still contains it even after you delete the line. For public repos, treat it as fully compromised until rotated.

This will come up in the upcoming auth, email, and payments lessons — every service you connect (Clerk, Resend, Stripe) will give you keys. The pattern is always the same: store in environment variables, never in code, rotate immediately if anything feels off.

Check yourself

Answer before opening — recalling it is what makes it stick.

Your AI coding assistant just wrote a config file with your Stripe secret key pasted directly in. What should you do right now?

Replace the key in the file with an environment variable reference (process.env.STRIPE_SECRET_KEY), store the actual key in your hosting platform's secret settings, and — if this file was ever committed to Git — rotate the key immediately because Git history preserves the old value even after you delete the line.

What is an environment variable, and why does it keep a key out of your code?

An environment variable is a named value stored in the server's configuration, outside the codebase. Your code references the variable's name; the server supplies the actual value at runtime. The key never enters a file, so it can't end up in Git history or a public repository.

You notice your OpenAI API bill spiked overnight and you didn't do it. What's the first thing you should do?

Rotate the key immediately. Go to the OpenAI dashboard, revoke the current key, and generate a new one. That stops any ongoing unauthorized usage right away. Then check the usage logs to understand what was called, and update your environment variables with the new key.