Where should API keys and secrets be stored?

Question

Accepted Answer

In a secret manager or your host's encrypted environment settings, never in the repository. Google Secret Manager, AWS Secrets Manager and Vault all do this. The rule is simple: if a secret is in git, treat it as public, because git history keeps it after you delete the file.

Anything shipped to a browser is public whatever you call it. A Firebase web API key or a Stripe publishable key is meant to be visible and is protected by rules and origin restrictions, not by secrecy. A key that must stay hidden simply cannot go in client-side code.

When a secret does leak, rotate it rather than removing the file. Rewriting history does not help once a key has been cloned, pushed to a fork or indexed. Rotation is the only action that actually invalidates what leaked.

Where should API keys and secrets be stored?

What does least privilege mean in practice?

What are security headers, and which ones matter?

What is rate limiting, and what does it actually protect?

Want this built, not just explained?