API keys must be stored in only one place. This single source prevents errors and security risks. All other copies of keys must be created automatically from this source.
By Pawan Nayar · from the LLOS AI Learning record
API keys must be stored in only one place.
This single source prevents errors and security risks. All other copies of keys must be created automatically from this source.
API keys, like those for OpenAI or Google, must be kept in one file. This file is typically named `.env`. No other file should have a hardcoded copy of these keys. Other files that need API keys should get them from this main `.env` file. This means if a key changes, it only needs to be updated in one place. This method prevents old or incorrect keys from being used by mistake. It also makes the system more secure because keys are not spread across many files. When a key is updated in `.env`, the server must be restarted. This makes sure all parts of the system use the new key.
A developer changes an OpenAI API key in the `.env` file. If other files have old, hardcoded keys, a web page might still use the wrong key. This causes the page to fail without showing an error related to the key change. If the system only reads from `.env`, the page will correctly use the new key after a server restart.
Resolved from this lesson's own record — real definitions, not invented for this page.
More from the same record, pulled by shared topic — not written new for this page.
API keys are sensitive information. They should be kept secret.
A developer must always read the root `.env` file first. This file contains the paid API keys.
A developer must never use a free-tier Google API key. Free tiers can use user data for training.
A developer should define a main workspace for all project files. Each server should have a specific task.
API keys must be stored in only one place. This single source prevents errors and security risks. All other copies of keys must be created automatically from this source.