Store & manage secrets like API keys in Python - Tech Tip Tuesdays

In this video, we explore how to securely manage and use secrets like API keys, passwords, credential pairs, and other sensitive information in python. We run through the basics of using environment variables and move on to more advanced scenarios such as managing different secrets for multiple environments.

0:00 Introduction
1:05 How not to store secrets
2:15 Environment variables
3:07 Creating environment variables
3:36 Using environment variables in python
5:03 Managing secrets with python dotenv
5:35 using .env file in Python
7:20 Protecting .env file
8:30 Managing multiple env files and environments
8:58 Using dotenv values, managing secrets in a dictionary
10:52 Using filename to change env secrets

[chrisseary]

You need to protect those secrets, and that isn't covered here. Encryption should be applied to the file contents, and restrictive ACLs should be applied to the file itself.

[SkielCast]

Some observations:
- The value of __name__ should not be use to determine environments
- To choose between environments, an additional environment variable called "environment" could be used, with a default value of "dev" to avoid errors
- Having multiple .envs in local could make sense but only as an edge case, production credentials should not be in ANY local machine
- If Python-dotenv is going to be a dependency, considered using tools like PDM, Poetry or Pipenv to make sure dependencies are locked

[mohammediftekharsalam]

Bro I am seeing this video on a Tuesday coincidentally

[mycinemax]

if i put .env or separate file to save secrets in my working server, how I protect it from outside hacker?

[andrewschneider]

So if the secrets aren't in git, how can other collaborators use the secrets if they pick up a story that uses this code or how do testers test this code if they can't access the secrets?

[shubhamtarkar]

Hi can you make a tutorial on implementing Ci-Cd with bitbucket and ggshield

[sqeipwh]

Uhm how to put them in a prod server, the secrets should not be in the server right

[lxvi]

how can I use this inside Aws Services like ERM-Studio? tnx