The SECRET_KEY and Signed Cookies
How Flask signs session data securely.
The SECRET_KEY and Signed Cookies is a free Flask Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Flask Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Where Sessions Live
By default Flask stores the whole session inside a cookie in the user's browser, not on your server. That has big implications.
The Tampering Problem
If data lives in the browser, a user could edit it. Flask stops that by signing the cookie so changes are detectable.
Meet the SECRET_KEY
Signing needs a secret. The SECRET_KEY is the private value Flask uses to stamp and verify every session cookie. 🔑
app.config['SECRET_KEY'] = 'change-me'No Key, No Sessions
Touch the session without a SECRET_KEY set and Flask raises a RuntimeError. It refuses to sign with nothing.
Signed, Not Encrypted
Important: a default session cookie is signed, not encrypted. Anyone can read it, so never store true secrets inside.
How Signing Verifies
On each request Flask recomputes the signature from the cookie and the key. A mismatch means tampering, so the session is rejected.
Make It Long and Random
A strong SECRET_KEY should be long and unpredictable. Generate one with the secrets module rather than typing a word.
import secrets
key = secrets.token_hex(32)Never Hardcode in Git
Keep the SECRET_KEY out of source control. Load it from an environment variable so each deploy has its own value.
import os
app.config['SECRET_KEY'] = os.environ['SECRET_KEY']Rotating the Key
Change the SECRET_KEY and every existing session signature stops matching. All users get logged out at once.
Same Key Everywhere
Run several app instances behind a load balancer? They must share one SECRET_KEY or each will reject the others' cookies.
Server-Side Alternative
Need bigger or hidden session data? Extensions like Flask-Session keep it on the server and store only an id in the cookie.
Quick Check
Think about what the default Flask session cookie actually protects.
Recap
You saw that SECRET_KEY signs session cookies to catch tampering. Make it long, load it from the environment, and never commit it. 🔐
Frequently asked questions
Is the “The SECRET_KEY and Signed Cookies” lesson free?
Yes — the full text of “The SECRET_KEY and Signed Cookies” is free to read here on the web, and the Flask Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Flask Academy course, upgrade to CoddyKit PRO.
What will I learn in “The SECRET_KEY and Signed Cookies”?
How Flask signs session data securely. You practise Flask Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Flask Academy?
No prior experience is required. Flask Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “The SECRET_KEY and Signed Cookies” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Flask Academy lesson?
Yes. Every Flask Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Set and Read the session Dict
- The SECRET_KEY and Signed Cookies
- Set Custom Cookies on a Response
- Flash Messages Between Requests