What Is an API Key? How to Store API Keys in .env Safely

When beginners who have just started playing with the ChatGPT API, the Gemini API or the Claude API ask our team, "I've got my API key, this long string of characters. Where in my code do I paste it?", the answer we give most often is "anywhere except your code." It sounds like a joke, but it is the most serious answer we can give.

It matters more now than it used to, because a new leak path has opened up: the AI tools that help us write code. Copying a whole file into ChatGPT to ask about a bug, or letting an AI coding agent read your entire project folder, both carry whatever is inside that code. If the key lives in the code, it travels everywhere the code goes.

Today Superdev Academy walks through what an API key actually is, why it leaks more easily than you would expect, the 3 habits worth building from your very first project, and what to do, in what order, if a key does get out.

What is an API key? Simply put, a password tied to your billing account

If you are not yet sure what an API is, read What Is an API first and come back. This article focuses only on the key that opens the API's door.

An API key is a string the provider issues so your program can identify itself every time it sends a request to their server. The server has no idea who is sitting at the keyboard. All it knows is which account's key came with the request, and it charges usage to that account. Send a wrong or revoked key and the server answers with a 401 error, which you can read about in HTTP Status Codes Explained.

Anthropic puts it most directly in its API Key Best Practices article: an API key is much like a credit card number. If someone obtains your key and uses it, the charges land on you.

An API key is not just a login. It is a code that can spend money from your account.

Each provider hands out keys from a different place: OpenAI keys come from the OpenAI Platform, Gemini keys from Google AI Studio, Claude keys from the Claude Console. The rules for keeping them safe are the same for all of them.

Why API keys leak more easily than you think

In a blog post dated April 1, 2025, GitHub reported that more than 39 million secrets were leaked across GitHub in 2024. That figure covers every kind of secret, including API keys, passwords and tokens, not just keys for AI services. Still, it is enough to show this is not a mistake only a careless few make.

If you have come close to doing it yourself, do not feel bad. Most leaks do not come from obvious carelessness. They come from small conveniences we all reach for every day.

• Hardcoding the key: writing it straight into a .py or .js file so the script runs quickly, then forgetting to take it out before pushing to GitHub.

• Putting it in frontend code: anything that runs in the browser can be read line by line by anyone who opens the site.

• Pasting code into a chat: dropping a whole file into ChatGPT or Claude to fix a bug without noticing the key came along.

• AI coding agents reading the whole folder: tools like Claude Code work by reading the files in your project. Unless you fence it off, the file holding your key is in view too.

The last two are the AI-era leak paths, and the principle Anthropic states on the same page about third-party tools such as web-based IDEs and CI/CD platforms applies to them just as well: putting your key into someone else's tool gives that tool's developer access to your account.

Habit 1: keep the key in a .env file

A .env file is a plain text file in your project folder that stores secrets as NAME=value lines. When the program runs, those values are loaded as environment variables. Your code only refers to the variable's name and never needs to contain the real value.

A .env file looks roughly like this. Every value below is a placeholder.

# .env  (never commit this)
OPENAI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxx
GEMINI_API_KEY=your-gemini-key-here
ANTHROPIC_API_KEY=your-claude-key-here

In Python, use the python-dotenv package, following the example Anthropic gives.

from dotenv import load_dotenv
import os

load_dotenv()
api_key = os.getenv("ANTHROPIC_API_KEY")

In Node.js, use the dotenv package and read the value from process.env.

require("dotenv").config();
const apiKey = process.env.OPENAI_API_KEY;

Variable names carry a small detail that saves a lot of effort. Google's documentation says the Gemini SDK picks up GEMINI_API_KEY or GOOGLE_API_KEY automatically, so if you name it correctly from the start, the key never has to pass through a single line of your code. For a deeper look at managing configuration in both Go and Node.js, continue with JS2GO EP.26 Using Environment Variables and Configurations.

Habit 2: add .env to .gitignore before your first commit

A .env file separates the key from your code, but if the .env file itself gets committed, nothing has been separated at all. That is why these two steps always go together.

A .gitignore file is a list that tells Git which files to ignore. Add these lines:

# .gitignore
.env
.env.*
!.env.example

The last line is a trick most teams use. Create a .env.example file that contains only the variable names, with no real values, and commit that instead. Anyone who clones the project knows which keys they need to prepare, and nobody ever sees yours.

The mistake beginners make most is the order of operations. Git's own documentation states plainly that .gitignore does not affect files Git is already tracking. If you commit .env first and add it to .gitignore afterwards, Git keeps tracking it. You have to run git rm --cached .env to stop tracking it first. If commit and push still feel unfamiliar, read What Is GitHub alongside this.

Habit 3: never put the key anywhere other people can see

The first two habits keep the key off GitHub. This one closes the remaining leak paths, and there are three main ones.

Frontend code: anything shipped to the browser can be read by the user. Vite's documentation warns directly that variables prefixed with VITE_ are bundled into your code at build time and should not contain sensitive information such as API keys. The Gemini API documentation likewise says not to hardcode keys into web or mobile apps, and to have a backend hold the key and make the calls, with the frontend going through that backend.

Chats with AI: before pasting code into ChatGPT or Claude, scan it for any line containing a key, every time. If your code already reads the key from .env, this problem almost disappears on its own, because the code only contains a variable name.

AI coding agents: these tools can be configured to stay away from certain files. The example in Claude Code's settings documentation adds Read(./.env) to the permission deny list so the agent never opens your .env file. If you have started using an agent to help you code, read How to Work with an AI Coding Agent as well.

My repository is private anyway. Do I really need to bother?

That is a fair point. If the repo is private and you work alone, outsiders cannot see its files, and today's risk is much lower than with a public repo.

But private does not mean private forever. One day you may make the repo public to put it in your portfolio, invite a friend to help, or connect it to several outside tools. Each time you do, every key that was ever committed in the history is exposed along with it, because Git remembers every commit that ever happened, not just the latest state of your files.

The other reason is habit.

People who set up .env and .gitignore by reflex do not slip up on the day the project really matters.

If an API key has already leaked, do this in order

Most people's first instinct is to delete the file and commit again. That is the wrong order, because the key is still in the history and still works. The right order is:

1. Revoke or rotate the key immediately: delete the old key in the provider's key management page and create a new one. GitHub's documentation says that when the leaked data is a secret, the first step is to revoke or rotate it, because once the key no longer works, anyone who cloned the repo cannot do anything with it.

2. Put the new key in your .env file: and check that .env really is in .gitignore.

3. Check your account's usage page: look for calls you did not make, and contact the provider if you find any.

4. Then clean the history: GitHub recommends the git-filter-repo tool for removing sensitive data from history. This step can wait, because the old key died at step 1.

Fun Fact: Anthropic takes part in GitHub's Secret Scanning Partner program. If a Claude API key turns up in a public GitHub repository, Anthropic automatically deactivates it and emails the owner. That is a safety net, not a reason to relax, and it does not help when a key leaks through a chat or through frontend code.

For the bigger picture of writing safe code beyond API keys, continue with Essential Secure Coding Techniques for Beginners.

Summary: what an API key is and how to keep it from leaking

An API key is the code a provider uses to tell which account a request came from and to bill that account. Whoever holds the key can spend your money. To put it plainly, there are only 3 habits to build from your first project:

• Keep the key in a .env file

• Add .env to .gitignore

• If a key leaks, revoke it first

And remember that frontend code, chats with AI, and AI coding agents are all places other people can see too.

If your project still has a key sitting in the code today, do not panic. Spend ten minutes moving it into .env, add the line to .gitignore, and replace the old key with a new one. Your next project will start from the right habit.

Follow more articles and tips for people starting out as programmers on our channels.

Facebook: Superdev Academy Thailand — https://www.facebook.com/superdev.academy.th

YouTube: Superdev Academy Channel — https://www.youtube.com/@SuperdevAcademy

Instagram: @superdevacademy — https://www.instagram.com/superdevacademy/

TikTok: @superdevacademy — https://www.tiktok.com/@superdevacademy?lang=th-TH

Website: superdevacademy.com — http://superdevacademy.com