Environment variables and API keys, without the mystery

Public settings might include a site URL or a provider's explicitly publishable identifier. Private settings include database passwords, privileged service credentials and API keys that let someone spend money or act as your app.

Read the provider's description of each key. Similar-looking strings can have very different permissions. A public browser key is not a substitute for access policies; it should only be used in the way the provider documents.

In a standard Vite project, variables with the VITE_ prefix are made available to client code and can be included in the built files. Never give a private AI key that prefix just to make an error disappear. Other frameworks have their own rules.

If the browser needs an answer from a paid service, send an authenticated request to your backend. The backend checks permission and usage limits, calls the provider with its private credential and returns the appropriate result. Keeping the key server-side alone does not prevent someone abusing an unprotected endpoint.

An empty production setting often explains why a feature works on your laptop but fails online. Check that the variable exists in the correct deployment environment; don't solve it by hardcoding the value into the source.

• List the names of required variables and document their purposes without values.
• Set production values in the host's secret or environment configuration.
• Keep preview and production credentials separate where the service supports it.
• Check whether each setting is read when the app builds or when a request runs.
• Rebuild or restart as required, then test the affected feature on the public URL.
• Keep local secret files out of Git and inspect changes before committing.

Revoke or rotate it with the provider. Deleting it from the latest commit or hiding the visible field does not make the old value safe again. Review available usage and access logs for unexpected activity.

Update the server's secret, deploy the corrected code and verify the old credential no longer works. Remove exposed values from the relevant repository history and artifacts as appropriate, but treat rotation as the urgent step. Avoid printing credentials while investigating.