Keys, secrets and .env files | Master AI Automation in 4 hours Master AI Automation in 4 hours Course About Ayush Modules Sample chapter Toolbox The Microcap Minute Classroom / Module 04: APIs: How Software Talks / Chapter 3 Keys, secrets and .env files Watch first, then read. Same lesson, your pace. What you will learn – What an API key is (and why it’s a credit card in disguise) – The .env pattern: keeping secrets out of your work – What to do the day a key leaks Your membership card, that bills you An API key is a long random string identifying you to an API: sk-proj-9f3k… -style. It’s simultaneously a username (“this is Ayush”) and a payment method (“bill his wallet”). Whoever holds your key is you, as far as the kitchen is concerned. Which creates the one rule of this chapter, worth tattooing: A key pasted into public code is a credit card handed to strangers. Bots scan GitHub for exposed keys within minutes and burn them on crypto mining or bulk AI calls. Real money, your account. Getting keys the free-first way For this course you need at most two: OpenRouter (openrouter.ai) → Settings → Keys → Create. One key, hundreds of models, :free ones cost nothing. This is your primary. Optional later: Google AI Studio for Gemini’s free tier; OpenAI/Qwen/Moonshot platforms when a specific paid model earns it. Store nothing yet, next section fixes where keys live. The .env pattern Never hardcode a key inside scripts ( api_key = “sk-…” = leak waiting). Instead, secrets live in a file named exactly .env , inside the project folder: OPENROUTER_API_KEY=sk-or-v1-xxxxx Scripts load it at runtime via a helper library; you’ll see the three lines of loading code in Chapter 5. Then make Git ignore it forever: echo “.env” >> .gitignore chmod 600 .env # only you can read it (Mac/Linux) Your personal convention from today: real keys live in .env files (or one master credentials.local.env with chmod 600); example placeholders live in code. If you ever show code publicly, others see structure, not secrets. If a key leaks anyway Don’t panic, rotate. Back to the provider’s dashboard: revoke the leaked key, create a fresh one, update .env . Total time: two minutes. The old string becomes dead plastic. Do this without embarrassment; even professionals rotate routinely. Try it yourself Create your OpenRouter account and first key. Build the venv home for this module: mkdir projects/api-lab && cd api-lab && python3 -m venv .venv && source .venv/bin/activate . Inside it: create .env with your key, run the chmod command, add .gitignore . Verify with ls -la (the dot-files appear, Chapter 3’s -a flag paying off). Never once paste the key into a chat window, not even AI chats. Key takeaways – API key = identity + billing; treat like a credit card. – Free-first: OpenRouter’s single key covers dozens of models including free ones. – Secrets live in .env + .gitignore + chmod 600, never hardcoded, never pasted anywhere. – Leaked? Revoke, regenerate, move on in two minutes. Download the exercise sheet (PDF) Module workbook (PDF) ← Prev: JSON: lunchboxes for data Next: First contact: curl → Classroom / Module 04: APIs: How Software Talks / Chapter 3 Keys, secrets and .env files What you will learn – What an API key is (and why it’s a credit card in disguise) – The .env pattern: keeping secrets out of your work – What to do the day a key leaks Your membership card, that bills you An API key is a long random string identifying you to an API: sk-proj-9f3k… -style. It’s simultaneously a username (“this is Ayush”) and a payment method (“bill his wallet”). Whoever holds your key is you, as far as the kitchen is concerned. Which creates the one rule of this chapter, worth tattooing: A key pasted into public code is a credit card handed to strangers. Bots scan GitHub for exposed keys within minutes and burn them on crypto mining or bulk AI calls. Real money, your account. Getting keys the free-first way For this course you need at most two: OpenRouter (openrouter.
Keys, secrets and .env files
Written by
in