Storing API Keys and Secrets Safely on Your Hosting

Storing API Keys and Secrets Safely on Your Hosting

Learn how to keep API keys, database passwords and other secrets out of your code and out of reach of visitors. AI tools sometimes write these values directly into project files, where they can be read by anyone who can see the file.

Steps

1. Ask your AI tool: Move every API key and password in this project into environment variables, and list the variables I need to set
2. Log in to Plesk via your Zeniar Portal
3. For a PHP project, select Files from the left-hand menu and open your project folder. This is the folder that contains your public folder, not the public folder itself
4. Click Add New, select Create File and name the file .env
5. Add one variable per line in the form NAME=value, then save the file
6. For a Node.js project, select Websites & Domains, click Node.js under Dev Tools, then click specify next to Custom environment variables. Add each name and value, save, and click Restart App
7. In a web browser, visit your domain followed by /.env. You should see an error page. If you see your keys, the file is in the wrong folder and must be moved straight away

Important: A .env file must never sit inside the folder your domain loads. If your project has no public folder, ask your AI tool to restructure it so that it does, then see Setting the Document Root for Your Project in Plesk

Important: Anything in code that runs in the visitor's web browser can be read by the visitor. Keys for paid services, such as an AI provider or a payment gateway, must only be used by code that runs on the server.

Please note: If a key has ever been in a public GitHub repository or anywhere else others could see it, changing the file is not enough. Cancel that key with the service that issued it and create a new one.

Your API keys and passwords are now stored away from your code and your visitors.