# Where to keep API keys and secrets so you never rotate in a panic

> Environment variables, secret managers, rotation, and the short list of places a key should never end up.

Published: 2025-06-27 · Source: https://subxcat.com/articles/secrets-management · Author: SUBXCAT

A secret is anything that grants access without a person's password: a payment provider key, an AI provider token, a database connection string, a mailbox password, the key that signs your sessions. In a prototype they usually sit wherever the assistant pasted them to make things work. A product needs something simpler and stricter.

## Where a secret never goes

- **Client code.** Anything shipped to a browser or a mobile app can be read. Watch for prefixes like `VITE_` and `NEXT_PUBLIC_`: a variable with one of those gets baked into the bundle, and the build tool will faithfully do what you asked.
- **Git.** Not in code, not in `.env`, not in a "temporary" config. Deleting the file in the next commit isn't enough. The secret stays in history, in forks and in the local clone of everyone who pulled in the meantime.
- **Logs and error trackers.** Logging "the whole request" and dumping environment variables on a crash are the two most common ways a secret leaks without anyone noticing.
- **Chat and tickets.** A key sent to a colleague in a messenger lives there longer than you'd think, and more people can see it than you'd think.

## Environment variables are a fine start

For a small project, environment variables on the server or in your hosting settings are a reasonable choice. A few rules:

- `.env` goes in `.gitignore`, and the repo has a `.env.example` with variable names and empty values. A new person sees what's needed without seeing the values.
- The app validates its config on startup and refuses to run if something's missing. A server that quietly boots without the payment key will fail later, at the worst possible moment.
- Each environment has its own keys. Test payment keys on staging, live keys only in production, never the other way around.

## When you need a secret manager

Environment variables start to hurt when there are many secrets, several services and more than two people on the team. A secret manager, whether from your cloud provider, your host or a standalone service, gives you what a `.env` file can't: an access log of who read what and when, permissions per environment and per person, versions and rollback.

The time to move isn't "once we've grown". It's when you can no longer answer "who currently has the production database key?" If the answer is "everyone who ever worked on the project", you're there.

## Least privilege

Most providers let you issue keys with limited scope: read-only, one project, specific operations. The key your service uses to send email shouldn't be able to change DNS. The analytics key shouldn't be able to issue refunds.

This lowers the cost of a leak. Leaking a send-only email key is unpleasant. Leaking an account admin key turns into a conversation about who owns your domain now.

## Rotation

Rotation means replacing a key on purpose. The point isn't a quarterly ritual. It's making replacement a practiced procedure instead of a 2 a.m. scramble.

Check in advance:

- Can you issue a new key without revoking the old one? Most services allow two at once, so you can swap without downtime.
- How many places need updating? If the key was pasted into five services by hand, rotation takes a day and something gets missed.
- Who does it, and where are the steps written down?

Rotation is mandatory after someone with access leaves, after a key lands in git or a log, and after any doubt at all. If you're not sure whether a key leaked, assume it did. Replacing it takes minutes; wondering takes months.

## Guarding against your own hurry

Add a secret scanner to pre-commit and CI. It catches strings that look like keys before they reach the repository. Many git hosts can also block pushes that contain known key formats. None of this replaces paying attention, but it covers the evening when attention ran out.

SUBXCAT can go through a project, find where the secrets live and who can reach them, and set up rotation so it stops being scary.