The short answer
Keep real keys out of chat, public repositories and screenshots. Use placeholders in examples and suitable secret storage for actual values. Exposed keys need revocation or rotation.
Try it in three steps
- Use a placeholder such as YOUR_API_KEY in practice configuration.
- Check commits and screenshots for actual values.
- If exposure occurred, follow the provider's recovery procedure.
A practice prompt
Before you start
Use literal placeholders, never actual credentials.
Practice material (fictional)
Example: API_KEY=YOUR_API_KEY. Public documentation explains the field; actual credentials belong in approved secret configuration.Replace placeholders in the prompt with this material, or append the material if there are no placeholders. Reading time excludes doing the exercise.
Explain configuration fields and secret locations without requesting, printing or copying real API keys.What to look for (not a recorded test result)
Explain configuration loading without requesting or printing real values. YOUR_API_KEY is not a working credential and should not be replaced with a real key in screenshots.
If it goes wrong
Deleting visible text does not restore secrecy; historical copies may remain.
Check your result
Examples are shareable without granting access to your account.
References and scope
The links below support the concepts or product navigation. The steps and exercises are our teaching suggestions, not official certification or measured customer outcomes. Product interfaces and availability may change. References checked on 2026-10-17.