Secrets management and API key rotation

How it works: secrets management

1. Keep secrets out of code and repos: load them from the environment or a mounted file; add .env to .gitignore and commit only a .env.example with placeholders (environments and config).
2. Store them in a secrets manager: a cloud secrets service, HashiCorp Vault, or your platform's secret store (e.g. GitHub Actions secrets, your host's environment settings). Access is logged and permissioned.
3. Inject at runtime: the platform passes secrets to the running service; fail fast at startup if one is missing (see the code).
4. Scope them: one key per service and environment (dev, staging, prod), minimal permissions, provider-side spending limits and usage alerts.
5. Keep keys server-side: browsers and mobile apps call your backend, which calls the model; never ship provider keys to clients.
6. Keep secrets out of model context: tools fetch what they need using credentials the model never sees (least privilege); redact secrets from logs and traces.
7. Scan: pre-commit hooks and repository push protection (e.g. GitHub secret scanning) block commits containing key-shaped strings; scan prompts and logs too.

How it works: API key rotation

1. Schedule rotation (e.g. every 90 days, or as policy requires) and rotate immediately when people leave or a leak is suspected.
2. Rotation steps: create a new key → store it in the secrets manager → deploy services so they pick it up → overlap period where both work → revoke the old key → confirm no traffic used it.
3. For keys you issue (your own API for customers), support two active keys per client and an overlap window (see the code).
4. After a leak, revoke first: kill the exposed key, replace it, then check usage logs for abuse and find how it leaked.
5. Prefer short-lived credentials where possible (workload identity, OIDC from CI to the cloud), so there's little to rotate.
6. Automate: rotation scripts or the secrets manager's built-in rotation, with alerts when keys get old.

import os, re, time
 
# SECRETS MANAGEMENT: read keys from the environment (filled by a secrets manager), fail fast if missing.
def require(name: str) -> str:
    value = os.environ.get(name)
    if not value:
        raise RuntimeError(f"{name} is not set")      # never fall back to a key in the code
    return value
 
os.environ["LLM_API_KEY_CURRENT"] = "key-v2-example"   # in production: injected by the platform
os.environ["LLM_API_KEY_PREVIOUS"] = "key-v1-example"
print("loaded:", require("LLM_API_KEY_CURRENT")[:7] + "...")
 
# API KEY ROTATION for keys YOU issue: accept old and new during an overlap window, then retire the old one.
ROTATED_AT, OVERLAP_S = time.time() - 3_600, 24 * 3_600       # rotated 1 hour ago, 24h grace period
def key_is_valid(presented: str, now: float) -> str:
    if presented == os.environ["LLM_API_KEY_CURRENT"]:
        return "valid (current)"
    if presented == os.environ["LLM_API_KEY_PREVIOUS"] and now - ROTATED_AT < OVERLAP_S:
        return "valid (previous, still in overlap window)"
    return "rejected"
print(key_is_valid("key-v1-example", time.time()))
print(key_is_valid("key-v1-example", time.time() + 2 * 24 * 3_600))
 
# SECRET SCANNING: block commits/prompts/logs that contain something shaped like a key.
SECRET_RE = re.compile(r"(sk-[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----)")
snippet = 'client = OpenAI(api_key="sk-' + "x" * 24 + '")'
print("secret found in code:", bool(SECRET_RE.search(snippet)))

loaded: key-v2-...
valid (previous, still in overlap window)
rejected
secret found in code: True