Load, mask, redact and scan for keys
The environment is a plain dictionary here so the example runs in the browser. The key-shaped strings are made up.
An API key is a password that spends your money. Keep it in an environment variable on a server, never in browser code, the repository or logs, route browsers through your own endpoint, and rotate it the moment it leaks.
Change the code and press Run (Ctrl+Enter). Predict what will happen first, then break it on purpose and read what changes. Your edits are saved and match the lesson page.
Ready for more? This phase has 6 hands-on exercises with automatic checks.
Practice questions
Write the code in the editor, run it, then open the model answer to compare.
Write mask(key) that returns the first 3 characters, ... and the last 4 characters, and show it on sk-abcdef123456.
Write require_env(env, names) that returns a list of the names missing or empty in the env dictionary.
Explain it without notes
Why can't an API key be used in front-end JavaScript?
What is the proxy pattern and what does it add besides hiding the key?
Walk through what to do after discovering a key in a public repository.
Expected output
loaded key: sk-...9901
missing key: MODEL_API_KEY is not set: export it in the shell or the deployment settings
raw log line: POST /v1/chat/completions Authorization: Bearer sk-live48271xyz9901
redacted log line: POST /v1/chat/completions Authorization: Bearer sk-...9901
files with a key in them: config.py:2, notes.txt:2