Before: the standard .env approach
.env.local (must never be committed)
OPENAI_API_KEY=sk-proj-<YOUR_OPENAI_KEY>STRIPE_SECRET_KEY=sk_live_<YOUR_STRIPE_KEY>GITHUB_TOKEN=ghp_<YOUR_GITHUB_TOKEN>✗Must be excluded from git (.gitignore)
✗Cannot be shared with teammates without risk
✗Cannot be committed even to private repos safely
✗Each new developer must get real keys manually
Migration steps
- 1.
Create tokens in the KeyVault Edge dashboard
Go to Tokens → New Token for each API key you want to protect. Enter the real key, select the provider, and add at least one allowed host (e.g.,
yourdomain.com,localhost). Copy the generatedkvt_...token. - 2.
Replace real keys with tokens in your environment
.env# Real keys are removed; each token is used with X-KV-TokenOPENAI_KVE_TOKEN=kvt_...STRIPE_KVE_TOKEN=kvt_...GITHUB_KVE_TOKEN=kvt_... - 3.
Keep .env out of git
Tokens carry your key in encrypted form and are only honoured from allowed hosts, which makes a leak far less damaging. They are still credentials: a server-side caller can send a matching Origin header. Keep
.envgitignored, give each environment its own token, and revoke any token that leaks. - 4.
Verify nothing broke
Terminalcurl https://proxy.keyvaultedge.com/v1/models \ -H "X-KV-Token: $OPENAI_KVE_TOKEN" \ -H "X-KV-Target: https://api.openai.com" \ -H "Origin: https://yourdomain.com"
After: what you've gained
.env file is safe to commit to version control
New developers get working API access by cloning the repo
Real keys never touch developer machines or CI pipelines
Breach alert fires if token is used from an unauthorized origin
Revoke a token in 2 seconds from the dashboard without rotating the real key