api keys

4 articles · newest first

Flat illustration of a person pointing at an item on a large menu while a kitchen hatch passes out a plate

What is an API? The menu your server serves

Lesson 5 of the journey of a tap: the list of requests a server will accept, why your app uses other people's too, and what an API key really is.

Sam Ortega · 39m ago · 4 min

Flat illustration of a person dropping a key into a locked drawer under a desk, with a dotted line to a small server

Build

Environment variables and secrets, explained: the .env file

Why your app's keys live in labelled envelopes outside the code, which envelopes the browser gets a copy of (VITE_, NEXT_PUBLIC_), and where secret keys actually belong, from the tools' own docs.

Sam Ortega · 42m ago · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

Build

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Sam Ortega · 42m ago · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Sam Ortega · 42m ago · 8 min