Home / Glossary / Secrets (API Keys & Tokens)

Secrets (API Keys & Tokens)

SFBy Sitraka Forler · Lecturer, Durham Business School·Updated 13 September 2026· About this site

Credentials such as API keys, passwords and tokens that grant access to a system.

A leaked API (application programming interface) key lets anyone act as you, so keep secrets out of code and Git: use environment variables, a secrets manager or your continuous integration (CI) secret store, and commit only a .env.example file with placeholder values. If one leaks, rotate it: revoke it and issue a new one. Deleting the commit is not enough: Git history and existing clones still hold the old value.

# local config, never committed
echo 'API_KEY=YOUR_API_KEY' > .env
# tell Git to ignore the file
echo '.env' >> .gitignore
# prints .env if it is ignored
git check-ignore .env