DEV Community

jay
jay

Posted on

hey codenewbie, don't expose api keys

When I first experimented with and implemented SendGrid email I left my api key hard coded in my app and pushed it to github. I tested an email, it worked, and I forgot about it. I received an email sometime later about an api key but I ignored it and moved on with whatever I was doing, probably pottery or eating multiple snacks. Sometime later I was working on an app and decided to implement SendGrid email into it, remembering how simple and effective it was. At that time I experienced lengthy pain and confusion in struggling with what I was missing or confused about, as well as figuring out how to become mosquito-proof. I kept seeing a status code 202, "The request has been accepted for processing, but the processing has not been completed". I went deep exploring dusty google hits on how to implement SendGrid. I procured strange headers from bootleg and unknown developers all over the web to try sending along with my request. Eventually I recalled some email about an api key and dug it up to take a look. #codenewbie. My SendGrid was disabled until I resolved the exposed api key.

Shoutout to Poul from SendGrid! For reactivating me after resetting everything and implementing .env and .gitignore, then disabling me again after I failed to first remove my already pushed .env that hadn't been ignored yet before pushing with a new key. Then reactivating me again later!

Top comments (0)