DEV Community

Cover image for EnvGo: Stop Leaking Your API Keys, Seriously Guys
Ketut Dana
Ketut Dana

Posted on

EnvGo: Stop Leaking Your API Keys, Seriously Guys

#go #api #security

Hey everyone,

Let me be honest with you. I did something stupid before.

I put my OpenAI API key directly inside my JavaScript file. Like this:

const API_KEY = "sk-live-abc123..."
Enter fullscreen mode Exit fullscreen mode

And pushed it. And yeah, anyone who opened DevTools could see it. My $5 credit gone in one night because someone scraped my key and used it. Painful.

If you are a frontend dev, solo learner, or just building a cool landing page with vanilla HTML + JS, you probably faced this same problem. You want to call an API, but you don't want to learn Express, setup Node, deploy a backend, just to hide ONE key. That feels overkill, right?

That's why I made EnvGo.

So, What is EnvGo?

EnvGo is a super simple idea. It's a single Go binary (around 2-8 MB, no Node, no npm install, no node_modules drama) that does two jobs at once:

  1. Serves your static HTML files
  2. Holds your .env secrets safely on the server

The magic is in how it handles secrets. You never write the real key in your JS. You just write a placeholder:

headers: { Authorization: "Bearer {OPENAI_API_KEY}" }
Enter fullscreen mode Exit fullscreen mode

Your browser sends literally {OPENAI_API_KEY} as text. EnvGo, running on the server, swaps it with the real value from your .env and forwards it to OpenAI. The secret never, ever reaches the browser. Not in DevTools, not in Network tab, not in memory. Clean.

Why I Built This?

I see many beginners stuck here. They can make a beautiful site with AI (Cursor, Claude), but once they need an API key, tutorials say "create a backend" and they give up.

EnvGo is the bridge — from index.html to "needs one secret" without learning a framework. Designer, student, or prototyping fast? This is for you. Need a database or auth? Use Next.js. EnvGo solves ONE problem well, intentionally.

How It Works (30 seconds) 

mkdir myapp && cd myapp
envgo init      # creates .env, index.html
# put real key in .env
envgo run dev   # http://127.0.0.1:8080
Enter fullscreen mode Exit fullscreen mode

HTML: <div id="MY_SECRET"></div> + <script src="/__env.js"></script> shows ✓ Success (hidden). JS calls /proxy with a token; for production, define fixed routes in envgo.routes.json and call fetch("/api/chat"). Hot-reload, dashboard, and typo detection included.

Where to Download?

It's free, MIT licensed, no telemetry, no account needed. Just grab the binary:

https://envgo.dev/download/

We have builds for macOS (Apple Silicon & Intel), Linux (amd64 & arm64), and Windows. Or get it from GitHub:

https://github.com/dnysaz/envgo/releases/latest

All links there always point to the latest version. Latest is v1.0.1 now with the new MODE_PUBLIC via .env feature.

Full docs are at https://envgo.dev — super honest about limitations too.

I Need Your Feedback!

This is made with love, but I'm sure it's not perfect. If the error message is confusing, or install fails on your laptop, or you have an idea — please tell me!

  • Bug or idea? Open an issue: github.com/dnysaz/envgo/issues
  • Security concern? Check SECURITY.md (report privately)
  • Just want to say hi or ask? Start a discussion on GitHub.

If you try EnvGo and it saves you one hour of backend setup, that's a win for me. Give it a star, try it on your next static project, and let me know what you think in the comments below.

Thanks for reading, guys. Happy coding and keep your keys safe!

— Ketut Dana

Top comments (0)