Passwords & API keys

Sooner or later your project will need to talk to another service: send an email, check a price, use an AI model. That service gives you an API key. It's a password for your project, not for you.

Treat every API key like your bank PIN. Anyone who has it can use your account, and some of them cost real money. There are exactly two safe places to keep one:

1. A secret file on your computer called .env, which never gets uploaded to GitHub.
2. Your project's settings on Vercel, if the project is on the internet.

Never paste a key into a chat window, an email, or a screenshot.

Start here:

1. Env files. What that secret file is and how to make one.
2. API keys. Step by step for each company: Claude, OpenAI, Stripe, Coinbase, and more.

You don't need this board until a project asks for a key. The spreadsheet guide doesn't.