DEV Community

Cover image for STOP Exposing Your API Keys in 2 Minutes

STOP Exposing Your API Keys in 2 Minutes

Technophile on October 17, 2024

Hey everyone, welcome back! In this post, I’ll show you how to store secret keys securely in a .env file. You can also watch the YouTube video if ...
Collapse
 
syeo66 profile image
Red Ochsenbein (he/him)

Or use dotenvx and even enjoy additional encryption capabilities.

Collapse
 
meley profile image
Martin Eley

You can also use the --env-file flag.

Collapse
 
lucaspereiradesouzat profile image
Lucas Pereira de Souza

only on nodejs 20v behind version not

Collapse
 
meley profile image
Martin Eley

Thank you

Collapse
 
thevediwho profile image
Vaibhav Dwivedi

Simple yet essential tutorial. Good one, friend!

Collapse
 
technoph1le profile image
Technophile

Thanks :)

Collapse
 
yidi profile image
Yidi Sprei

Caution!!!! This is very insecure. Do not store secrets in env files. That is not what they are meant for.
Whenever possible use secret managers instead. They are built for production. If you are on aws, you don't need to store any secrets as environment variables. Your servers (or serverless servers) have access roles and you can let them access your AWS secrets manager and use something like that. Other cloud providers have very similar setups. Do not use environment variables or environment files to store critical secrets in production.

Collapse
 
_bbb2762792e3f125a5ad7b profile image
张磊

i have simple and convinent way to store and use .env.

  1. just add a priviate submodule:
  2. put your sensitive info to the submodule.
  3. write a copy script in your main project,to copy .env from your submodule.
  4. every time u init your project,run the script
Collapse
 
ngtduc693 profile image
Duc Nguyen Thanh

that ways I tried

Collapse
 
jwp profile image
John Peters

Looks dangerous to me. A better idea is to use environment variable instead. That way there's no chance of exposure.

Collapse
 
miguelgisbert profile image
Miguel Gisbert

And how to make it work on prod?

Collapse
 
technoph1le profile image
Technophile • Edited

You can already deploy it to production (through GitHub). Your secret keys will be in .env file and it's ignored by GitHub, so not visible to others. And, NodeJS will handle the rest.

Collapse
 
anmolbaranwal profile image
Anmol Baranwal

Or you can use secret management platform like infisical. It's free!

Collapse
 
rafaelassumpcao profile image
Rafael A • Edited

What a great tool, so to use infiscal you have to provide api keys (which are considered sensitive info) which will put you in a infinite loop. Awesome!

Ps: I'm just joking around, I think it's a really interesting free solution, I will use it myself. Thanks for sharing

Collapse
 
anmolbaranwal profile image
Anmol Baranwal

You almost got me lol 🤣