Which way should be used to safely the API keys?

Question

Options

• AIn an environment variable unique to the system database
• BEncrypted in a configuration file that is separate from the code
• CEncrypted in the code in a function
• DPlain text in the code as a constant

• A
  88% (14)
• B
  6% (1)
• D
  6% (1)

Explanation

Storing API keys in environment variables keeps sensitive credentials out of source code and version control repositories, significantly reducing the risk of accidental exposure. Hardcoding keys as plain-text constants is a critical security vulnerability. Encrypting them inside the code still embeds them in the codebase. While a separate encrypted configuration file is better than plain text in code, environment variables are the standard best practice because they are managed at the OS/runtime level, are not committed to repos, and can be rotated without code changes.

No community discussion yet for this question.