# .env (never commit this file)
PICTIFY_API_KEY=pic_live_...

// Load from environment
const pictify = new Pictify({ apiKey: process.env.PICTIFY_API_KEY });

import { SecretsManager } from '@aws-sdk/client-secrets-manager';

const client = new SecretsManager();
const response = await client.getSecretValue({ SecretId: 'pictify/api-key' });
const apiKey = response.SecretString;

const pictify = new Pictify({ apiKey });

import { SecretManagerServiceClient } from '@google-cloud/secret-manager';

const client = new SecretManagerServiceClient();
const [version] = await client.accessSecretVersion({
  name: 'projects/my-project/secrets/pictify-api-key/versions/latest'
});
const apiKey = version.payload.data.toString();

import Vault from 'node-vault';

const vault = Vault({ endpoint: process.env.VAULT_ADDR });
const result = await vault.read('secret/data/pictify');
const apiKey = result.data.data.api_key;

# secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: pictify-credentials
type: Opaque
stringData:
  api-key: pic_live_...

# deployment.yaml
env:
  - name: PICTIFY_API_KEY
    valueFrom:
      secretKeyRef:
        name: pictify-credentials
        key: api-key

// During rotation, try both keys
const keys = [
  process.env.PICTIFY_API_KEY_NEW,
  process.env.PICTIFY_API_KEY_OLD
].filter(Boolean);

async function makeRequest(options) {
  for (const key of keys) {
    try {
      const pictify = new Pictify({ apiKey: key });
      return await pictify.renderHtml(options);
    } catch (error) {
      if (error.status === 401 && keys.indexOf(key) < keys.length - 1) {
        continue; // Try next key
      }
      throw error;
    }
  }
}

// ❌ Never do this
const pictify = new Pictify({ apiKey: 'a3f8c2...' }); // never hardcode

// ✅ Use environment variables
const pictify = new Pictify({ apiKey: process.env.PICTIFY_API_KEY });

# ❌ This exposes your key
git commit -m "Add API integration"

# ✅ Use .gitignore
echo ".env" >> .gitignore

❌ "Here's the API key: a3f8c2d914..."
✅ "I've added the key to the team secrets manager"

# ❌ Development with production key
PICTIFY_API_KEY=YOUR_PRODUCTION_KEY npm run dev

PICTIFY_API_KEY=YOUR_DEVELOPMENT_KEY npm run dev