2 hours ago
Short answer: never hardcode them, never commit them, and use each tool's built-in credential store.
n8n – use the Credentials section (API keys / OAuth2 are encrypted at rest), then reference them like {{$credentials.name}}.
Make – same idea via the Keys & Scopes section.
Python – .env file + python-dotenv, loaded through os.environ, and make sure .env is in .gitignore before you push anything.
The 5-point checklist I use:
1. Secrets only in env vars / credential stores
2. .env never committed
3. Keys scoped to the minimum permissions
4. Rotation schedule (quarterly is a good start)
5. Alerts on unexpected usage
Question: how do you store secrets in your stack – env files, a vault, or something else? Drop your setup below 👇
n8n – use the Credentials section (API keys / OAuth2 are encrypted at rest), then reference them like {{$credentials.name}}.
Make – same idea via the Keys & Scopes section.
Python – .env file + python-dotenv, loaded through os.environ, and make sure .env is in .gitignore before you push anything.
The 5-point checklist I use:
1. Secrets only in env vars / credential stores
2. .env never committed
3. Keys scoped to the minimum permissions
4. Rotation schedule (quarterly is a good start)
5. Alerts on unexpected usage
Question: how do you store secrets in your stack – env files, a vault, or something else? Drop your setup below 👇