Keep API Keys Out of Your Git History

When you are building a weekend project or finishing an assignment, pasting an API key into your code can feel like a harmless shortcut. The problem is what happens when that shortcut becomes a commit. Deleting the key later does not remove it from earlier versions. Keeping credentials out of Git from the start is simpler than cleaning up afterward. ([docs.github.com](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository?ref=grant-winney))

First, check whether a key already needs replacing

Before changing your setup, inspect your pending changes and recent commits for credentials. If you find a real key in committed material, treat it as exposed and revoke it through the service that issued it. Create a replacement and update the applications that need it. Do this before spending time cleaning repository history. Revocation addresses the working credential; history cleanup addresses the stored copy. ([docs.github.com](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository?ref=grant-winney))

Review usage and charges for the affected account, too. Make a note of unfamiliar activity without copying the secret into an issue, support message, or shared document. For a student project, an unexpected bill deserves attention just as much as a broken build.

Give the replacement key a home outside your code

Choose how your application will receive its credential before you resume development. For local work, use an environment variable or a local secrets file that your application loads at runtime. For automated builds, use the platform's secret store rather than placing the value in the workflow definition. GitHub Actions, for example, supports stored secrets that workflows can access. ([docs.github.com](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions))

Keep a shareable example of the settings your project needs, but use an unmistakably fake placeholder instead of a working credential. Explain how another developer should supply their own key. Aim for a project that someone can understand without receiving access to your account.

Make Git ignore local credentials before adding them

Add your local secrets file to the repository's ignore rules before saving a real credential there. Then inspect the list of pending changes in your Git client. Confirm that the secret-bearing file is absent while your safe example remains available to commit. Ignore rules apply to untracked files; they do not stop Git from tracking a file it already knows about. ([git-scm.com](https://git-scm.com/docs/gitignore/?utm_source=openai))

If the file is already tracked, remove it from Git's tracked set while retaining the local copy you need. Check the pending changes again. Remember that this prevents future tracking, not access to an earlier committed version. An exposed key still needs replacing. ([git-scm.com](https://git-scm.com/docs/gitignore/?utm_source=openai))

Review the exact changes you are about to commit

Before each commit, open the staged changes rather than relying on a list of filenames. Look through settings, examples, notebook output, and debugging text. Ask whether every included value would be safe to publish. Stage only the changes you understand.

Enable secret scanning and push protection where your repository host supports them. GitHub push protection checks for supported secret patterns and can block a push containing a detected credential. Treat that as a backup, not permission to skip review: detection depends on the patterns and protections available. ([docs.github.com](https://docs.github.com/en/code-security/secret-scanning/introduction/about-push-protection))

Clean existing history without mistaking it for revocation

If a credential reached earlier commits, decide whether a history rewrite is needed after revoking it. Follow your host's sensitive-data removal procedure, coordinate with anyone sharing the repository, and verify the cleaned history before publishing it. Rewriting changes commit identifiers, and older clones or forks can retain the original material. A cleanup cannot recall every copy. ([docs.github.com](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository?ref=grant-winney))

Keep credential safety connected to your spending routine

If you use MyRelay, apply the same handling to your relay key. Its one-key, one-budget approach brings supported AI services together, while request-level token and cost visibility gives you a place to review spending. Keep that convenience separate from credential storage: your repository should contain application logic, not your working key. ([myapirelay.com](https://myapirelay.com/))

Create a MyRelay account if that setup suits your workflow. Then make your final check repeatable: inspect staged changes, confirm local secrets stay untracked, and review usage after testing. The aim is a small routine you can maintain even when a deadline is close.