Safe & Affordable Bots: Approvals, Security, Costs

Leaked API keys get abused within minutes. Three rules:

1. Never in code or chats. Use environment variables or a .env file listed in .gitignore.
2. One key per bot. If one leaks, you revoke one, not everything.
3. Rotate keys every few months and immediately if you suspect a leak.

Using a .env file

# .env  (add ".env" to .gitignore!)
ANTHROPIC_API_KEY=sk-ant-...
TELEGRAM_TOKEN=123:abc...

Python: pip install python-dotenv then from dotenv import load_dotenv; load_dotenv().

Check you didn't commit a secret

git grep -n "sk-ant-"
Select-String -Path .\* -Pattern "sk-ant-" -List

If a key was ever pushed to GitHub, revoke it in the provider's console now. Deleting the file isn't enough: it stays in history.

Hosted secrets

On Cloudflare Workers use npx wrangler secret put ANTHROPIC_API_KEY; on n8n use Credentials. Secrets set this way never appear in your code.