Unit 7 · Data that lasts
Publishable vs secret API keys
Not every key is secret. Publishable keys are designed to be public and can only start safe actions, like opening a checkout. Secret keys can move money or read data, and they never leave the server.
The mix-up
What people often think
“Every key is secret.”
What the tutor says
Publishable keys are made to be public. They can only start actions, like opening a checkout, never move money. The secret key does the dangerous work.
How it works
A .env.example file with empty values is also safe to commit: it lists the variable names teammates need, not the secrets.
Webhook signing secrets are secrets. They prove a message really came from the provider; leak one and anyone can fake a “payment succeeded” event.
Close cousins of this mix-up
The tutor watches for these in the same lesson.
“Any file named .env is dangerous to commit.”
A .env.example with empty values is a list of names, not secrets. It shows teammates which variables to set.
“A webhook secret is harmless because it is not an API key.”
The signing secret proves a message really came from the provider. Leak it and anyone can fake a "payment succeeded" event.
Practise it with a tutor watching
APIs and auth basics
Keep secret keys on the server and explain how a site knows who you are after you log in.
Free with an account. The first two units need no account.