API keys are easy to copy and easy to leak. A key placed in source code can spread into repository history, developer clones, build artifacts, logs, backups, and forks. Safe storage begins by separating configuration from source code.
Do not hard-code secrets
Application source code should reference a configuration value rather than contain the secret directly. This reduces accidental exposure in repositories and code reviews.
Local development
For local development, environment variables or a local secrets file excluded from version control can be practical. Developers should use non-production credentials where possible and avoid sharing one master key across the entire team.
CI/CD systems
Most CI/CD platforms provide protected secret variables. Restrict which pipelines, branches, and maintainers can access them. Avoid printing environment variables or command output that can reveal secrets in build logs.
Production servers
Production credentials should be provided through an operating-system secret store, dedicated secrets manager, container secret mechanism, orchestration platform, or another controlled configuration system. File permissions alone may be insufficient for high-value secrets.
Use separate keys per environment
Development, testing, and production should not depend on the same API credential. Environment separation limits the impact of a development leak and makes rotation less disruptive.
Scope the key
If the provider supports scopes, permissions, IP restrictions, application restrictions, or expiration, use them. A key that can only read one resource is safer than a key with unrestricted administrative access.
Protect logs
HTTP headers, query strings, debugging dumps, and exception traces can accidentally expose tokens. Redact known secret fields and avoid sending API keys in URLs where they may be retained by proxies, analytics tools, or browser history.
Rotate exposed keys
If a key is committed to source control or posted in a ticket, assume it may have been copied. Revoke or rotate it, then remove the exposed value from the repository or ticket. Deleting the visible line without rotating the key is not sufficient.