Environment variables and secrets, without leaks
A secret key published by mistake can get expensive within hours, and coding agents do not always know where to store it. This lesson teaches you to map your app's environment variables, to separate public keys from secret ones, to place each one where it belongs and to know how to respond if a leak happens.
Lesson objective
By the end of this lesson, you will be able to map your app's environment variables, tell publishable keys from secret keys, put each secret in the only place it should live (a local file ignored by Git, the host's settings, the server functions' secrets) and respond to a leak.
Topics covered
- environment variables
- secrets management
- API keys
- secret leaks
- app security
Where it fits
Decide on the architecture and protect your secrets
What has to leave the browser, on which platform, and where does each key belong?
Lessons in this module
- What has to leave the browser, and where to put it
- Environment variables and secrets, without leaks (this lesson)
What you will learn in this module
This lesson is part of the course Add a database, authentication and payments to your app
- Decide what stays in the browser and what must move to the server, and choose a back-end platform that fits your app, your budget and your data.
- Manage environment variables and secrets (public VITE_ variables, secret keys on the server only, .env files kept out of Git, rotation after a leak).
Related courses
- AI & DevelopmentJuniorSome basics are useful: introductory knowledge of the topic.
Build and ship a web app with an AI coding agent
2 hr 45 min
- AI & DevelopmentAdvancedRegular practice: you already use the tools or work on this topic.
Work with Claude Code on a real project: context, planning, review
3 hr
- Product ManagementAdvancedRegular practice: you already use the tools or work on this topic.
Git for PMs: ship as a team without putting production at risk
3 hr 30 min