Load Secrets from Environment Variables
Keep keys out of source with env vars.
Load Secrets from Environment Variables is a free Flask Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Flask Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Secrets Do Not Belong in Code
API keys and passwords pasted into source files leak the moment you push to Git. Keep secrets out of your repository entirely.
The Twelve-Factor Idea
The twelve-factor approach stores config in the environment, so the same code ships everywhere with no edits.
Read One with os.environ
Use os.environ to read a variable. It raises a clear error if the key is missing, which is great for required secrets.
import os
key = os.environ["SECRET_KEY"]Optional Values with get
Use os.environ.get for optional settings and supply a fallback so your app still boots in development.
debug = os.environ.get("DEBUG", "0")Wire It into a Config Class
Read env vars right inside your Config class so every environment gets its secrets from the system, not the source.
SECRET_KEY = os.environ.get("SECRET_KEY")Set a Variable in the Shell
On your machine, export the value before running. The process inherits it, and Flask picks it up.
export SECRET_KEY=super-secretEverything Is a String
Env vars arrive as strings. Convert numbers and booleans yourself, since "0" is truthy in Python.
port = int(os.environ.get("PORT", "5000"))Fail Fast on Missing Secrets
In production, a missing secret should crash on startup, not midway. Fail fast so the problem is obvious immediately.
if not SECRET_KEY:
raise RuntimeError("SECRET_KEY required")Where the Platform Sets Them
Hosts like Heroku, Docker, and Kubernetes inject env vars at deploy time, so no secret ever sits in your image.
Generate a Strong Key
A SECRET_KEY should be long and random. Generate one with secrets.token_hex and store it as an env var.
import secrets
secrets.token_hex(32)Never Log a Secret
Avoid printing config that holds secrets. A stray log line in a dashboard exposes the very value you protected.
Quick Check
How should you handle a required secret that is missing in production?
Recap: Env Secrets
You read secrets from os.environ, gave optional ones defaults, converted types, and failed fast when required keys were missing. 🔐
Frequently asked questions
Is the “Load Secrets from Environment Variables” lesson free?
Yes — the full text of “Load Secrets from Environment Variables” is free to read here on the web, and the Flask Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Flask Academy course, upgrade to CoddyKit PRO.
What will I learn in “Load Secrets from Environment Variables”?
Keep keys out of source with env vars. You practise Flask Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Flask Academy?
No prior experience is required. Flask Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Load Secrets from Environment Variables” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Flask Academy lesson?
Yes. Every Flask Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Config Classes per Environment
- Load Secrets from Environment Variables
- Use dotenv in Development
- Toggle Debug and Feature Flags