Get your API key off GitHub

Hardcoded my key to test something quickly. Forgot to take it out before I pushed.

BeginnerRead 5 minDoing: 30 to 45 minutes alone; longer if you need to coordinate a re-clone with teammates6 steps

▶ Start

What you'll have at the end

Your key moved to an environment variable, with a secret scan of your git history coming back clean.

Before you start

You need

A repository already pushed to GitHub with a real API key hardcoded somewhere inside it, and sign-in access to that key's own provider dashboard.

Not covered

This doesn't cover wiring a scanner to run automatically before every future commit; that's a prevention habit worth adding separately, not part of cleaning up a key that's already public.

Leans on

LLM APIs and Integration Cheat SheetLays out the environment-variable and key-rotation patterns this recipe moves your code onto.
Environment Variables and Shell Configuration Files Cheat SheetCovers the local key file's format and the gitignore habit that keeps a fixed key from leaking a second time.
Git and GitHub Cheat SheetDocuments the history-rewriting command this recipe's cleanup step runs.
Cloud Secrets Management Cheat SheetLists the scanning tool this recipe's last step runs, plus where to go if a plain local file ever stops being enough.

6 steps

Checked 15 Aug 2026

Part of the LLM APIs and Integration cookbook