API Key Storage and Rotation: A Practical Guide for Small Teams

Most leaked keys are not stolen by clever attacks. They are pasted into a public repository, a screenshot or a chat. A few habits remove almost all of that risk and cost nothing.

Where keys should live

• Environment variables or a secrets manager on the server.
• A .env file outside the public web folder and excluded from version control.
• A password manager for the humans who need to see it.

Where keys must never live

• In JavaScript that runs in the browser.
• In a mobile app package that anyone can unpack.
• In a public or shared repository, even in an old commit.
• In a support chat or a ticket.

Rotating a key

1. Create the new key in the provider dashboard.
2. Deploy it to the server and confirm that requests succeed.
3. Disable the old key.
4. Check the logs for calls that still use the old key.
5. Record the date so the next rotation is easy to schedule.

When a key leaks

1. Disable it immediately, before you investigate.
2. Create a new key and deploy it.
3. Review recent usage and the account balance for activity you did not make.
4. Find out how it leaked and fix that path.

Small habits that help

• One key per application, so you can disable one without breaking the rest.
• Rotate on a schedule and whenever someone with access leaves.
• Add secret scanning to your repository if your host offers it.

For OtpGet users

Your key is in your account area and it spends your wallet, so treat it like a bank card number. See the API page for how it is used.

A worked rotation example

Suppose a developer leaves. You create a new key, deploy it on Monday morning, watch the logs until traffic uses only the new key and disable the old key in the afternoon. If something breaks, you have a short window to roll back. Compare that to disabling first: it saves time but can stop customers.

Questions to review every quarter

• Who has the key and do they still need it?
• Is any copy outside the password manager and the server?
• When was it last rotated?
• Do logs or error pages ever print it?

Questions people ask

How often should I rotate?

At least when staff change and after any suspicion. A scheduled rotation every few months is a good habit.

Is a .env file safe?

Yes, if it is not in the public folder or in version control.

Related guides and pages

• OTP API for developers
• Laravel service class
• Pricing and refund rules

Create a free OtpGet account and try it with a small balance.