What is an API key, and how do I keep it safe when vibe coding?

An API key is essentially a unique digital password—a long string of characters—that acts as your identification when you connect your code to an external service, like OpenAI, a database, or a cloud provider. It tells the service who is making the request and ensures you have the proper permissions.

When you are "vibe coding"—moving fast, prototyping, and experimenting—it is very easy to accidentally bake that key into your code. If you upload that code to a public place like GitHub, others can find it and use your account, which could lead to unexpected costs or security breaches.

Here is how to keep your keys safe while staying in your flow:

1. Use Environment Variables

Never write the key directly into your .py, .js, or .env.example files. Instead, create a file named .env in your project folder. Put your key there like this: MY_API_KEY=your_secret_key_here

Then, use a library (like dotenv for Python or dotenv for Node.js) to load that key into your code at runtime.

2. The Golden Rule: Use .gitignore

Before you push your code to any repository, create a file named .gitignore in your project root. Add .env to the first line of that file. This tells your version control system to completely ignore the file containing your keys, so it never gets uploaded to the cloud.

3. Use Environment-Specific Keys

If the service allows it, create a "development" key that has restricted access or spending limits. This way, if something does go wrong, the damage is minimized.

4. Rotate Keys Immediately

If you suspect you’ve accidentally pushed a key to a public repository—even for a split second—assume it is compromised. Go to the service provider’s dashboard, delete (or "revoke") that key, and generate a new one. Services like GitHub have automated bots that scan for leaked keys and often revoke them for you, but it’s best to be proactive.

A quick tip for the road: If you ever find yourself needing to share code with a friend to show them your "vibe," double-check that you haven't included your .env file or hardcoded any strings that look like long, random alphanumeric sequences.

Stay safe and happy building!