Manage API Keys Safely in a Small Project
An API key is a credential, not a piece of public configuration. A small project needs a clear way to store, use and replace keys without committing them to source code or exposing them in a browser. Build that habit before adding more services and collaborators.
Why it matters
A leaked key can remain in repository history, logs or a deployed bundle after you remove it from the current file. Recovery starts with revoking or rotating the credential, rather than only deleting visible text.
A practical workflow
- Keep service credentials in the platform's supported secret store or an appropriate local environment configuration excluded from version control.
- Use separate credentials for development and production, with the narrowest available permissions for each task.
- Inspect client bundles, logs and screenshots so private server keys do not appear in public output.
- Enable appropriate secret detection and write a short rotation process for an accidental exposure.
An example
A browser form should call your controlled server endpoint rather than include a private AI provider key in page JavaScript. The server can validate requests and enforce usage rules. Obfuscating a key in the browser does not make it secret.
A mistake to avoid
Do not paste real credentials into prompts, support screenshots or example repositories. Also avoid sharing one personal key among a team when the service offers scoped project credentials and clearer ownership.
Try it and check the result
Search a test build and repository history using harmless marker values. Confirm the private configuration stays server-side, and rehearse rotating a development key so the process is familiar before an incident.
Reference and further reading
GitHub's secret scanning documentation.
The workflows and examples in this guide are illustrative. Product controls and availability can change; check the linked official guidance for your setup.
Continue with Serverless vs a VPS for a Small Project or explore all blog topics.