Secrets, Environments, and Deployment
Keep API keys in deployment secrets or a secret manager, rotate them, scope them to the minimum privileges, and never log them. Separate development, staging, and production credentials. Ensure build systems do not embed server-only environment variables into public frontend bundles. Review provider key usage, quotas, and alerting.
Deployment needs health checks, timeouts, graceful shutdown, retry policy, schema migrations, and rollback plans. If using serverless or edge runtimes, check duration limits, streaming support, package compatibility, and connection management. Long-running jobs often belong in workers rather than request handlers.
Environment configuration
function requireEnv(name) {
const value = process.env[name];
if (!value) throw new Error(`Missing required environment variable: ${name}`);
return value;
}
const providerApiKey = requireEnv("AI_PROVIDER_API_KEY");💡 Fail fast at startup when required configuration is missing. Do not include the secret value in the error message or logs.
Key Takeaways
- Keep server-only secrets out of browser bundles.
- Use separate environment credentials and rotation.
- Validate deployment limits and graceful shutdown behavior.
Knowledge Check
What should an application do when a required API secret is missing?