API keys must only be stored in the .env file. The env.js file is automatically created and updated from .env. No API key should ever be written directly into code.
By Pawan Nayar · from the LLOS AI Learning record
API keys must only be stored in the .env file.
The env.js file is automatically created and updated from .env. No API key should ever be written directly into code.
API keys are sensitive information. They should be kept secret. The .env file is the only place to store API keys. This file is not shared publicly. The server automatically creates env.js from the .env file. It also serves this file to the application. Developers must never manually change env.js. Developers must never paste keys into HTML, JavaScript, or Python files.
A developer updates an OpenAI key in the .env file. The developer forgets that an old key was hardcoded into an HTML file. The application then fails because it uses the old, incorrect key from the HTML file. The developer must find and remove the hardcoded key.
Resolved from this lesson's own record — real definitions, not invented for this page.
More from the same record, pulled by shared topic — not written new for this page.
API keys, like those for OpenAI or Google, must be kept in one file. This file is typically named `.env`.
A developer must always read the root `.env` file first. This file contains the paid API keys.
A developer must never use a free-tier Google API key. Free tiers can use user data for training.
A developer should define a main workspace for all project files. Each server should have a specific task.
API keys must only be stored in the .env file. The env.js file is automatically created and updated from .env. No API key should ever be written directly into code.