Accounts, keys and money

Member lesson

Where keys live: .env files, never chat or git

Lesson 5 of 7 in Accounts, keys and money.

Checked against the makers' documentation on 25 September 2026.

Python Tutorial: Securely Manage Passwords and API Keys with DotEnv · Corey Schafer
3.4 Hiding API Keys with Environment Variables (dotenv) and Pushing Code to GitHub · The Coding Train
Secure your secrets at runtime with the 1Password CLI and Environments · 1Password
Lesson

Each project folder gets a .env file holding only the keys that project needs, and a .gitignore line that keeps git away from it. The code reads names and never values. In Python, load_dotenv from python-dotenv copies the file into the environment, Node has had a built-in --env-file flag since version 20.6, and uv run takes --env-file too. Commit a .env.example beside it with the names and empty values, so whoever opens the project next knows what it needs.

safer1password op runreal value only while it runsmacos keychainoff disk, any script can ask.env + .gitignoreone project, never committedexport in ~/.zshrcevery program, every windowtyped into the codea leakpasted in a chata leakbelow the line, the key has already left
Where a key can live, safest at the top: 1Password op run, the macOS Keychain, a .env file kept out of git, an export in the shell file, typed into code, pasted into a chat or commit; the last two are leaks.
An ink drawing of a small green wall safe with its door open and a purple key hanging on a hook inside, and a blank yellow sticky note stuck on the wall beside it.
The key lives in the safe. The sticky note stays blank.
Member

The rest of this is for members.

You have read the opening of this lesson. The rest of it comes with a membership.

One membership covers all four courses and Brands.

  • All lessons in the four Learn courses
  • All brand breakdowns in the Brands section
  • All quizzes, flashcards and crosswords
  • An AI teacher on every lesson, for up to 60 questions a day
  • All course material published during the membership

Price

Membership is from $12 a month on the Yearly plan, which is charged at $144 once a year. Lifetime access is $59, paid once.Membership is from ₹200 a month on the Yearly plan, which is charged at ₹2,400 + GST once a year. Lifetime access is ₹3,999 + GST, paid once.

Check what stuck

Members only

You can't take this check yet.

Members answer these 3 questions and keep the ticket for this lesson. Every lesson has one.

  1. Question 1, locked

    Which of these words means this? “A plain text file of NAME=value lines that a program loads when it starts.”

    • .env file
    • Homebrew
    • PATH
    • Shell
  2. Question 2, locked

    Which of these words means this? “The list of files git must never pick up.”

    • Shell
    • Terminal
    • Rotation
    • .gitignore
  3. Question 3, locked

    Which of these words means this? “The file ~/.zshrc, which zsh runs every time a window opens.”

    • Header
    • API key
    • Shell profile
    • API

Elsewhere in the library

Hear about new courses.

Leave an email and we will tell you when something new lands. We do not write often.