Summary
API keys are the most-leaked category of secret in production. A leaked OpenAI key can cost thousands in a weekend. Discipline: never in code, never in Git, always in a vault, always with rate limits and monitoring.
Objectives
- 01State the four rules of API key hygiene.
- 02Name a secret-management approach for each stage (local, CI, production).
- 03Recognize the signs of a leaked key.
The Lesson
The rules
1. Never in code. 2. Never in Git (even in .env.example). 3. Different keys per environment. 4. Every key has a spending cap. Violate any of these and you will eventually pay for it.
The stack
Local: .env with .gitignore and direnv. CI: encrypted secrets in the runner. Production: HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, Doppler. Every request logged; alerts on unusual spend.
Key Ideas
- API keys leak; assume yours will, and cap the blast radius.
- Different key per environment; spending cap on every key.