← VCE Software Development U4O1

Keeping API keys secure

A secret code that identifies your program to an API. Keep it in a separate file, out of the repository and shared code, because it is linked to your usage limits.

Part of: VCE Software Development - U4O1 - development and evaluation — Module 125, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 113, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 54, QCE Digital Solutions Unit 4 — Prototype Digital Data Exchanges — Module 94

Understanding Keeping API keys secure in VCE Software Development U4O1

What it does: Adding the key file to .gitignore means git will not track it, so it stays out of the repository. The key is loaded at run time from the separate file, so the source code contains no secret. Anyone who sees the key can use it as if they were you, so keys must never appear in shared code. The key identifies who is making requests, so the provider can apply usage limits and monitor use. The old key remains in the commit history, so it must be treated as compromised and replaced. Keeping the key in its own file that is not committed stops it being shared when the code is pushed.

Common mistakes: This is not Python syntax. The key lives in a separate config.py file, so import it with: from config import API_KEY. Typing the key straight into this file means it gets shared and committed with the code. Import it from a separate file instead: from config import API_KEY.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Keeping API keys secure to a class →

This module's key terms are also in a printable crossword (Modules 125–171) and word search (Modules 115–171).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Where is the safest place to keep an API key?
In a separate config file that is not sharedTyped directly into the main program code
Matches
API_KEY = 'a8f3k29xq71z' requests.get(url, params={'key': API_KEY})
↓
The API key is typed directly into the code, so anyone who sees or copies the code or repository can use it. Store it in a separate file that is not committed.
Applying
Meanings
Term
API key
Meaning
A secret code that identifies your program to an API. Keep it in a separate file, out of the repository and shared code, because it is linked to your usage limits.
Practice
import requests
Testing
Gaps
from keys KEY
Check Answer
Spots
1import requests
2import API_KEY from config

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Ostrich' badge — Full Sprint, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Where is the safest place to keep an API key?
A. In a separate config file that is not shared ✓
B. Typed directly into the main program code
Keeping the key in a separate file means the main code can be shared without exposing the key.
2. Your project is stored in a Git repository. What should you do with the file holding your API key?
A. Commit it so teammates can always find it
B. Leave it out of the repository (e.g. add it to .gitignore) ✓
Anything committed stays in the repository history, so a key file should never be committed.
3. True or false: it is fine to post code containing your API key in a public forum if the program works.
A. False ✓
B. True
Anyone who sees the key can use it as if they were you, so keys must never appear in shared code.
4. Which line keeps the API key out of the main program?
A. API_KEY = 'abc123secret'
B. from config import API_KEY ✓
Importing the key from a separate config file keeps the secret out of the main code. Hard-coding it exposes it.
5. Why does an API provider give each program its own API key?
A. To identify the program and track its usage ✓
B. To make the program run faster
The key identifies who is making requests, so the provider can apply usage limits and monitor use.

Match the Pairs

API_KEY = open('key.txt').read().strip() → Loads the API key from a separate file so the secret is not written directly in the program code
key.txt → A separate file that holds the API key and is listed in .gitignore so it is not committed to the repository
Stop git from committing the file that holds your API key, so it is not pushed to a shared repository → echo key.txt >> .gitignore
Read the key from a separate file when the program runs, instead of typing the secret into the code → with open('key.txt') as f: api_key = f.read().strip()
API_KEY = 'a8f3k29xq71z' requests.get(url, params={'key': API_KEY}) → The API key is typed directly into the code, so anyone who sees or copies the code or repository can use it. Store it in a separate file that is not committed.
git add key.txt git commit -m 'Add API key' → The file holding the API key is committed to the repository, so the secret is shared with everyone who can see it. Add the file to .gitignore instead.

Key Term

API key
A secret code that identifies your program to an API. Keep it in a separate file, out of the repository and shared code, because it is linked to your usage limits.

Fill in the Blanks

1. from keys import KEY
Hint: Type the keyword that brings a name from the separate key file into this program
2. echo "keys.py" >> .gitignore
Hint: Type the name of the file that lists what git must not commit to the repository
3. params = {"key": KEY}
Hint: Type the variable holding the secret key that was loaded from the separate file
4. limit = 100 if calls > limit: print("Limit exceeded")
Hint: Type the comparison operator that checks whether the number of calls has gone past the usage limit
5. KEY = open("key.txt").read().strip()
Hint: Type the file method that returns the whole contents of the key file as a string

Spot the Error

Question 1
A import requests
B import API_KEY from config
C p = {'key': API_KEY}
D r = requests.get(URL, p)
Line B — This is not Python syntax. The key lives in a separate config.py file, so import it with: from config import API_KEY.
Question 2
A API_KEY = 'sk-12345'
B import requests
C p = {'key': API_KEY}
D r = requests.get(URL, p)
Line A — Typing the key straight into this file means it gets shared and committed with the code. Import it from a separate file instead: from config import API_KEY.
Question 3
A import os
B import requests
C key = os.environ('API_KEY')
D r = requests.get(URL, {'k': key})
Line C — os.environ is a dictionary-like object, not a function, so it cannot be called with brackets. Use square brackets: os.environ['API_KEY'].
Question 4
A from requests import get
B calls = 0
C LIMIT = 100
D if calls > LIMIT:
E r = get(URL, params=p)
F calls += 1
Line D — The key has a usage limit, so requests should only be sent while calls is below it. The condition must be calls < LIMIT, otherwise no request is ever made.
Question 5
A # .gitignore
B main.py
C __pycache__/
Line B — The .gitignore file must list the file that holds the API key, config.py. Ignoring main.py hides the program and leaves the key file to be committed.

Student with a class code? Join your class →