Keep Secrets Out of Code
Store credentials safely, not in plain text.
Keep Secrets Out of Code is a free Arduino & IoT Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Arduino & IoT Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Counts as a Secret
WiFi passwords, API tokens, and private keys are all secrets. Anything that grants access must never sit in plain sight inside your sketch. 🔑
The Danger of Plaintext Keys
Flash memory can be read back over the wire. A plaintext key in your code is one chip dump away from being copied by anyone.
String apiKey = "AKIA12345SECRET"; // visible to anyone who reads the flashWhy Git Makes It Worse
Commit a secret once and it lives in your history forever. Even after you delete it, the old commit still holds the exposed key.
Use a Separate Header
Put credentials in a small file like secrets.h kept out of version control. This secrets header keeps keys off GitHub while your sketch stays shareable.
#include "secrets.h" // holds WIFI_SSID and WIFI_PASS, never committedIgnore It in Git
Add your secrets file to .gitignore so it can never be committed by accident. This single line prevents most real-world key leaks.
# .gitignore
secrets.hProvision at Setup Time
Instead of baking keys in, enter them once when the device first boots. Provisioning via a config page keeps secrets off your source entirely.
Store in NVS or EEPROM
The ESP32 offers NVS, a key-value store in flash for runtime secrets. You write the token once and read it back on every boot.
preferences.begin("net", false);
preferences.putString("token", userToken);One Device, One Key
Give each unit its own credentials, never a shared master key. With per-device keys, one stolen device can be revoked without touching the rest.
Rotate and Revoke
Plan to change keys on a schedule and kill leaked ones fast. Rotation limits how long any single stolen secret stays useful.
Least Privilege
Give each token only the access it truly needs. Least privilege means a leaked device key can read its own topic, not your whole account.
Scan Before You Push
Tools can catch a key before it reaches a remote repo. A secret scanner in your workflow blocks accidental leaks before they happen.
Quick Check
One of these keeps a key off your public repo.
Recap
Never bake secrets into code. Use a gitignored header, provision at setup, store in NVS, and keep per-device keys you can rotate. 🔐
Frequently asked questions
Is the “Keep Secrets Out of Code” lesson free?
Yes — the full text of “Keep Secrets Out of Code” is free to read here on the web, and the Arduino & IoT Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Arduino & IoT Academy course, upgrade to CoddyKit PRO.
What will I learn in “Keep Secrets Out of Code”?
Store credentials safely, not in plain text. You practise Arduino & IoT Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Arduino & IoT Academy?
No prior experience is required. Arduino & IoT Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Keep Secrets Out of Code” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Arduino & IoT Academy lesson?
Yes. Every Arduino & IoT Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Common IoT Attack Surfaces
- Keep Secrets Out of Code
- Encrypt with TLS & Verify Certs
- Sign & Lock Down Firmware