Keeping API keys secure

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Where is the safest place to keep an API key?

A In a separate config file that is not shared

B Typed directly into the main program code

2. Your project is stored in a Git repository. What should you do with the file holding your API key?

A Commit it so teammates can always find it

B Leave it out of the repository (e.g. add it to .gitignore)

3. True or false: it is fine to post code containing your API key in a public forum if the program works.

A False

B True

4. Which line keeps the API key out of the main program?

A API_KEY = 'abc123secret'

B from config import API_KEY

5. Why does an API provider give each program its own API key?

A To identify the program and track its usage

B To make the program run faster

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1API_KEY = open('key.txt').read().strip()		Awith open('key.txt') as f: api_key = f.read().strip()
2key.txt		BA separate file that holds the API key and is listed in .gitignore so it is not committed to the repository
3Stop git from committing the file that holds your API key, so it is not pushed to a shared repository		CLoads the API key from a separate file so the secret is not written directly in the program code
4Read the key from a separate file when the program runs, instead of typing the secret into the code		Decho key.txt >> .gitignore
5API_KEY = 'a8f3k29xq71z' requests.get(url, params={'key': API_KEY})		EThe API key is typed directly into the code, so anyone who sees or copies the code or repository can use it. Store it in a separate file that is not committed.
6git add key.txt git commit -m 'Add API key'		FThe file holding the API key is committed to the repository, so the secret is shared with everyone who can see it. Add the file to .gitignore instead.

Definitions

API key

Fill in the Blanks

Complete each line of code by filling in the missing parts.

from keys ______ KEY

echo "keys.py" >> __________

params = {"key": ___}

limit = 100 if calls _ limit: print("Limit exceeded")

KEY = open("key.txt").____().strip()

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A import requests

B import API_KEY from config

C p = {'key': API_KEY}

D r = requests.get(URL, p)

Question 2

A API_KEY = 'sk-12345'

B import requests

C p = {'key': API_KEY}

D r = requests.get(URL, p)

Question 3

A import os

B import requests

C key = os.environ('API_KEY')

D r = requests.get(URL, {'k': key})

Question 4

A from requests import get

B calls = 0

C LIMIT = 100

D if calls > LIMIT:

E r = get(URL, params=p)

F calls += 1

Question 5

A # .gitignore

B main.py

C __pycache__/

Answer Key

Keeping API keys secure

Section A: Quick Questions

A — In a separate config file that is not shared

B — Leave it out of the repository (e.g. add it to .gitignore)

A — False

B — from config import API_KEY

A — To identify the program and track its usage

Section B: Match the Pairs

API_KEY = open('key.txt').read().strip() → Loads the API key from a separate file so the secret is not written directly in the program code

key.txt → A separate file that holds the API key and is listed in .gitignore so it is not committed to the repository

Stop git from committing the file that holds your API key, so it is not pushed to a shared repository → echo key.txt >> .gitignore

Read the key from a separate file when the program runs, instead of typing the secret into the code → with open('key.txt') as f: api_key = f.read().strip()

API_KEY = 'a8f3k29xq71z' requests.get(url, params={'key': API_KEY}) → The API key is typed directly into the code, so anyone who sees or copies the code or repository can use it. Store it in a separate file that is not committed.

git add key.txt git commit -m 'Add API key' → The file holding the API key is committed to the repository, so the secret is shared with everyone who can see it. Add the file to .gitignore instead.

Section C: Definitions

API key — A secret code that identifies your program to an API. Keep it in a separate file, out of the repository and shared code, because it is linked to your usage limits.

Section D: Fill in the Blanks

from keys import KEY

echo "keys.py" >> .gitignore

params = {"key": KEY}

limit = 100
if calls > limit:
    print("Limit exceeded")

KEY = open("key.txt").read().strip()

Section E: Spot the Error

B — This is not Python syntax. The key lives in a separate config.py file, so import it with: from config import API_KEY.

A — Typing the key straight into this file means it gets shared and committed with the code. Import it from a separate file instead: from config import API_KEY.

C — os.environ is a dictionary-like object, not a function, so it cannot be called with brackets. Use square brackets: os.environ['API_KEY'].

D — The key has a usage limit, so requests should only be sent while calls is below it. The condition must be calls < LIMIT, otherwise no request is ever made.

B — The .gitignore file must list the file that holds the API key, config.py. Ignoring main.py hides the program and leaves the key file to be committed.