Free course Beginner to advanced

Free API Key Security Course

A free learning path on API keys and secrets: how to create, store, rotate and revoke them. No signup. Every lesson is on this page.

CreateStoreRotateRevokeReplace
Start Module 1 Check a Key Length
Learning Path

Four Levels, One Habit: Treat Every Key as a Password

An API key is a shared secret. Anyone who holds it can call the API as you.

Beginner

Create and store

Generate keys with enough randomness, keep them out of git and out of browser code.

Intermediate

Scope and manage

Least privilege, one key per service and environment, secrets managers and CI secrets.

Advanced

Rotate and revoke

The dual-key rotation pattern, rotation schedules, and the leak response order.

Expert

Remove static keys

Short-lived tokens, workload identity federation and dynamic secrets.

The Course

Five Modules on API Key and Secrets Security

Each module is a short checklist for a real project.

Module 1 · Beginner

Create API keys that cannot be guessed

  • Use a cryptographically secure generator. In Python use the secrets module, in Node.js crypto.randomBytes, in the browser crypto.getRandomValues. Never use Math.random, timestamps or user IDs.
  • Aim for at least 128 bits of randomness. That is 16 random bytes, or 32 hex characters, or 22 base64url characters. Use the calculator below to check a format.
  • Add a readable prefix such as sk_live_. A fixed prefix lets secret scanners, such as GitHub secret scanning, and people spot a leaked key.
  • Store only a hash on the server and show the full key to the user once. For long random keys, SHA-256 is enough.
Module 2 · Beginner

Store keys where they cannot leak

  • Never commit a key. Put .env in .gitignore and run a pre-commit scanner such as gitleaks or TruffleHog.
  • Never ship a secret key to the client. Front-end JavaScript and app bundles are public. Use publishable keys, such as Stripe's pk_ keys, there and keep sk_ keys on the server.
  • Load keys at runtime from environment variables or a secrets manager: HashiCorp Vault, AWS Secrets Manager, Google Secret Manager or Azure Key Vault.
Module 3 · Intermediate

Scope every key to the least privilege

  • One key per service and per environment. A leaked staging key must not open production.
  • Give each key only the permissions it needs. Use read-only keys and IP restrictions where possible.
  • Track key age and last use. Delete keys nobody uses.
Module 4 · Advanced

Rotate without downtime, revoke without panic

  • Dual-key rotation: create a new key, deploy it next to the old one, switch traffic, wait until the old key's last-used time stops changing, then revoke it.
  • Set a schedule and automate it. The CIS AWS Foundations Benchmark flags IAM access keys older than 90 days. AWS Secrets Manager and Vault can run rotation for you.
  • After a leak, revoke first. Bots scan public commits, so treat a pushed key as copied. Revoke or rotate at the provider, deploy the replacement, check the audit logs for calls you did not make, then clean history with git filter-repo or BFG.
Module 5 · Expert

Replace long-lived keys with short-lived credentials

  • Use roles and temporary tokens. AWS IAM roles issue temporary credentials through STS; OAuth 2.0 client credentials issue access tokens that expire.
  • Use OIDC workload identity federation in CI. GitHub Actions can exchange its OIDC token for cloud credentials on AWS, Google Cloud and Azure, so no static key is stored in the repository.
  • Use dynamic secrets. Vault can issue a database credential per request with a lease, and revoke it when the lease ends.
  • AI agents and MCP servers get their own scoped keys, passed through the environment, never pasted into prompts.
Free Tool

API Key Entropy Calculator

See the bits of entropy of a key format and the average time to guess it. It assumes a secure random generator.

Method: entropy = length × log2(character set size); average guesses = half the key space. The 112-bit minimum and 128-bit target follow the security strengths in NIST SP 800-57 Part 1. Educational tool, not a security audit.

Bar chart of API key entropy by format: an 8-character password has 52 bits, 20 alphanumeric characters 119 bits, 32 hex characters 128 bits, and 43 base64url characters 258 bits
A 32-character hex key reaches the 128-bit target; an 8-character password has less than half of that.
FAQ

API Key Security Questions

How long should an API key be?

Use at least 128 bits of randomness from a secure random generator. That is 16 random bytes, written as 32 hex characters or 22 base64url characters. Many providers use 32 bytes (256 bits).

How often should I rotate API keys?

There is no single rule. Rotate on a fixed schedule (the CIS AWS Foundations Benchmark flags access keys older than 90 days), and rotate at once after a suspected leak or when a person with access leaves.

What should I do first if I leak an API key?

Revoke or rotate the key at the provider first. Treat the key as already copied. Rewriting git history comes after, because forks, clones and caches keep the old commit.

Are environment variables safe enough for API keys?

They keep keys out of source code, but any process on the host and some crash reports can read them. For production, a secrets manager adds access control, audit logs and automatic rotation.