2025-11-22 · · Daniel A

How to Securely Store API Keys and Secrets

Best practices for storing API keys, tokens, and secrets safely.

Let's be honest: we've all stored API keys in a notes.txt file on our desktop at some point.

Or worse: committed them to a public GitHub repo. Or pasted them in Slack. Or emailed them to ourselves. Every developer has done something like this. And every time, we knew it was wrong.

Here's how to do it right.

Never Do These Things

Commit API keys to version control
Store keys in unencrypted text files
Send keys via email or Slack
Paste keys directly in code
Share keys in screenshots or screen recordings

The Real Risks

API keys leaked to public repos get found within minutes. Bots constantly scan GitHub for exposed credentials. Once found, they're used for cryptocurrency mining, spam campaigns, or sold on dark web markets.

The cost can be devastating. AWS keys can rack up $50,000+ in charges overnight. Stripe keys can process fraudulent transactions. OpenAI keys can burn through your credits in hours.

The Right Approaches

For Production: Use a Secrets Manager

AWS Secrets Manager, HashiCorp Vault, or your cloud provider's equivalent. These are designed specifically for this purpose. Secrets are encrypted at rest, access is logged, and rotation is automated.

For Development: Use Environment Variables

Store secrets in a .env file that's gitignored. Load them at runtime. Never commit them. For sharing with teammates, use a secure channel and have everyone maintain their own .env file.

.gitignore Essentials

For Personal Reference: Use an Encrypted Notes App

You still need quick access to keys for personal projects, testing, and reference. The solution: an encrypted personal knowledge base.

This is exactly why we built SimplyBoard. Store your API keys, tokens, and credentials with client-side encryption. Search instantly when you need them. Access from any device. Sleep well knowing they're not in plaintext anywhere.

Why SimplyBoard for API Keys

Client-side AES-256 encryption
Instant search across all your keys
Access from any device
Offline support for when you're on a plane
We can't see your keys even if we wanted to

Key Rotation

Rotate your keys regularly. If a key has been exposed (or you suspect it might have been), rotate immediately. Most services let you generate new keys without downtime.

Good secrets management isn't about paranoia. It's about reducing the blast radius when (not if) something goes wrong.

Quick Checklist

Production secrets in a proper secrets manager ✓
Development secrets in .env files (gitignored) ✓
Personal reference keys in an encrypted notes app ✓
Regular key rotation scheduled ✓
No secrets in code, logs, or version control ✓

· The SimplyBoard Team

Write fast. Find faster.
Stay private.

The trusted, encrypted alternative to Notion, Trello, and Miro. A fast, private knowledge base for developers, founders, and power users who need to store and retrieve information without friction · encrypted, searchable, and offline-ready.

No credit card required. Free for personal use.

How it works

1. Capture anything

Paste a command, save a snippet, or jot a note. Each entry supports plaintext or Markdown · no rigid templates.

2. Find it instantly

Type in the search bar and results appear instantly with fuzzy matching. Frequently accessed entries naturally rise to the top.

3. Stay in control

Everything is encrypted on your device before syncing. Works offline, no folders required, no lock-in.

Your data, your control

SimplyBoard uses AES-256-GCM encryption with PBKDF2 key derivation (100,000 iterations). Every entry is encrypted before it leaves your device. Our servers store only ciphertext · we cannot read your data under any circumstances. Even if our database were compromised, your data remains unreadable without your password or passphrase.

Zero-knowledge architecture

✓ SOC 2 Type 2 Infrastructure ✓ ISO 27001:2022 Infrastructure ✓ GDPR Compliant

Frequently Asked Questions

Is SimplyBoard really free?

Yes! SimplyBoard is free for personal use. We believe everyone deserves access to a private, secure knowledge base.

How does client-side encryption work?

Your password (or passphrase for Google sign-in) is used to derive an encryption key using PBKDF2 with 100,000 iterations. All your entries are encrypted with AES-GCM before leaving your device. We never see your decrypted data·not even our servers can read it.

How does encryption work with Google sign-in?

After signing in with Google, you create a separate encryption passphrase. This passphrase works exactly like a password for encryption·it derives the key that protects your data. Your Google account only handles authentication, not encryption. We cannot recover your passphrase or open your vault without it.

Can I switch between email and Google sign-in?

No. Once you register with a specific method (email/password OR Google), you must continue using that same method. Each method uses a different encryption key derivation, so they cannot be interchanged.

What happens if I forget my password or passphrase?

Because of our zero-knowledge architecture, we cannot recover your password or passphrase, or decrypt your data. This is by design·it ensures that only you can access your information. We recommend storing your password or passphrase in a secure password manager. Your account will be deleted after 90 consecutive days of inactivity.

What is the 90-day inactivity policy?

Accounts that are not accessed for 90 consecutive calendar days will be permanently deleted without notice. This helps us manage storage costs and keeps the platform lean.

Can I use SimplyBoard offline?

Yes! SimplyBoard works fully offline. Your entries are cached locally and sync automatically when you reconnect to the internet.

Is my data backed up?

Your encrypted data is stored securely in the cloud and synced across all your devices. The encryption ensures that even if someone accessed the server, they couldn't read your content.

What makes SimplyBoard different from Trello, Miro, or Notion?

SimplyBoard is built for speed and simplicity. No feature bloat, no expensive subscriptions, no learning curve. Just fast search, secure storage, and instant retrieval.

Can I self-host SimplyBoard?

Not currently. SimplyBoard is a cloud-hosted service to enable cross-device sync without you managing infrastructure. While your content is encrypted client-side, you are trusting us with metadata like your email and when entries are saved.

How to Securely Store API Keys and Secrets

Never Do These Things

The Real Risks

The Right Approaches

For Production: Use a Secrets Manager

For Development: Use Environment Variables

.gitignore Essentials

For Personal Reference: Use an Encrypted Notes App

Why SimplyBoard for API Keys

Key Rotation

Quick Checklist

Write fast. Find faster.
Stay private.

Everything you need, nothing you don't

Instant Search

Client-Side Encryption

Multiple Workspaces

Keyboard-First

Cross-Device Sync

Offline Support

How it works

1. Capture anything

2. Find it instantly

3. Stay in control

Your data, your control

Frequently Asked Questions

Stay in the loop

How to Securely Store API Keys and Secrets

Never Do These Things

The Real Risks

The Right Approaches

For Production: Use a Secrets Manager

For Development: Use Environment Variables

.gitignore Essentials

For Personal Reference: Use an Encrypted Notes App

Why SimplyBoard for API Keys

Key Rotation

Quick Checklist

Write fast. Find faster. Stay private.

Everything you need, nothing you don't

Instant Search

Client-Side Encryption

Multiple Workspaces

Keyboard-First

Cross-Device Sync

Offline Support

How it works

1. Capture anything

2. Find it instantly

3. Stay in control

Your data, your control

Frequently Asked Questions

Stay in the loop

Write fast. Find faster.
Stay private.