Keep passwords and API keys out of your code

Use this guide when your code contains passwords, API keys, database connection strings or tokens, or before you share a project or deploy it. Have your project open, access to the services whose keys you use and your hosting platform's settings.

Step by step

1. Find every secret

   Search your code for words like password, key, token, secret and connection strings. Check configuration files, scripts and test files too. List each secret and which service it belongs to.