How to keep API keys out of your code

It starts with one test key pasted into a file “just for now”. Then the file is committed, the repository goes public and someone else is running up a bill on your account. Keeping secrets out of code is a habit you set up once.

A setup routine, then secrets managers for Mac. Deleting a leaked key from the code does not remove it from git history or from anyone who copied it. If a key leaks, revoke it at the provider and issue a new one first, then clean up.

Secrets managers rising by visits and sponsorship on Censuus

A younger app from an independent developer:

Ranked by visit traffic and sponsorship on Censuus, not editorial opinion. The list changes as new apps appear and gain traffic.

Move secrets out of the repo

Load keys from environment variables or a local secrets manager at run time, and commit only an example file with empty values. Compare tools in secrets managers for Mac.

Guard the commit

Add .env and key files to .gitignore before the first commit, and run a secret scanner as a pre-commit hook. Many code hosts can also block pushes that contain known key formats.

Limit each key

Create separate keys per project and environment with only the permissions they need, and protect provider accounts with two-factor sign-in. See how to set up two-factor authentication.

Keep personal passwords apart

A password manager for logins and a secrets tool for development keys keeps both tidy. See how to start using a password manager. For app projects, see how to prototype a SwiftUI app.

Compared from each developer’s own store description.
Step	What you do	Why
1. A vault	secrets manager or env	keys live outside code
2. .gitignore	.env and key files	never committed
3. Scan	before every push	catch the slip
4. Least access	one key, one job	smaller damage
5. Leak plan	revoke and rotate	stop misuse fast

Frequently asked questions

Where should I store API keys?

Outside your code, in environment variables or a secrets manager, loaded when the app runs.

I pushed an API key to GitHub. What now?

Revoke the key at the provider and create a new one first, then remove it from the code and history.

Is a .env file safe?

Only if it never gets committed. Add it to .gitignore and keep an example file without real values.