3.4 Hiding API Keys with Environment Variables (dotenv) and Pushing Code to GitHub
Why Stack Overflow recommends it
Stack Overflow users link it when answering questions about leaking or hard-coding API keys, as a quick walkthrough of using a .env file with dotenv.
Recommended by 1 people across 1 different months, 2021 to 2023.
What it is
A short lesson from Daniel Shiffman's Intro to Data and APIs in JavaScript course on The Coding Train. It shows how to keep an API key out of public code using environment variables and the dotenv package, then how to push the project to GitHub.
What people said
Recommends Alon Barad · 2021-07 · Stack Overflow · on “Supabase with React Full Register / Login / Account website”
You shouldn't post your API key to the world, one way to do it is by using environments variable, when you deploy your frontend code (for example using Netlify or Vercel) you can add environments variables and then access them from within your code. This is a nice video explaining what I just said [this video] @neyeror358
Cites Paideswra Perisetti · 2021-06 · Stack Overflow · on “Front end Sensitive info”
1.first we need install DotENV in you are project command: npm install dotenv and now check in your package.json file install or not , if install file we can see like this "dotenv": "^10.0.0", and we can configure the file in your file in top of the file like "require('dotenv').config();" and now where you want now your using .env file. first we need to understand how to using .env file in your file any .env file are using (process.env) and more information for Sensitive info Questions please go to the like [this video] Thankyou,
Cites Pratham · 2021-09 · Stack Overflow · on “Trying to use a POST call on the Skyscanner API”
You don't need to pass your API Key as a literal string. Pass it something like this: "x-rapidapi-key": KEY, P.S. Use environmental variable [this video] to pass the API key as this is a sensitive credential.
Cites Gaurang Mestry · 2023-06 · Stack Overflow · on “Mailchimp keeps revoking/disabling my API key”
Why this is happening is because your API key is meant to be private as anyone who access to the API key can do some damage (In this case tamper or delete your contacts on Mailchimp). In your code the API is visible which triggers a safety mechanism in Mailchimp which ultimately revokes/disables your API key. The best practice (On localhost) is to create a .env file where you store your API key or any other sensitive information. Now you can paste your API key in the .env file like this API_KEY = YOUR_API_KEY You can then request for it using process.env.API_KEY Note that you have to install the dotenv package and require in your code. Note that the above process only works locally and is ju