Config & Secrets via Environment
Load settings without hardcoding credentials.
Config & Secrets via Environment is a free MCP Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the MCP Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Never Hardcode Secrets
An API key typed straight into your code can leak the moment you push to Git. Keep secrets out of source files entirely.
The Environment Holds Config
The standard place for settings is the environment. Your server reads values at startup instead of baking them into the build.
import os
api_key = os.environ["WEATHER_API_KEY"]Same Code, Many Setups
Reading from the environment lets one build run in dev, staging, and prod by simply swapping the variables around it.
Required vs Optional Values
Use indexing for a required value so a missing key fails loudly, and getenv with a default for optional ones.
key = os.environ["DB_URL"]
timeout = int(os.getenv("TIMEOUT", "30"))Validate Config at Startup
Check every setting when the server boots, not on the first request. Fail early with a clear message about what is missing.
Centralize in a Settings Class
Gather all values into one settings object so the rest of your code reads tidy attributes instead of scattered getenv calls.
class Settings:
db_url = os.environ["DB_URL"]
timeout = int(os.getenv("TIMEOUT", "30"))Pydantic Settings Helps
The BaseSettings class reads env vars, casts types, and validates them for you, turning loose strings into a checked config object.
from pydantic_settings import BaseSettings
class Settings(BaseSettings):
db_url: str
timeout: int = 30Use .env for Local Dev
A local .env file keeps your machine's values handy, but it must be gitignored so those values never reach the repository.
DB_URL=postgres://localhost/dev
TIMEOUT=15Never Log Secrets
When you print config for debugging, mask sensitive fields. A token in a log line is just as exposed as one in the code.
Inject Config, Don't Reach for It
Load settings once and pass them into your services through the lifespan. Avoid scattering os.environ reads deep in the code.
Document Every Variable
Keep a sample .env.example listing each variable with a comment. New users can copy it and know exactly what to fill in.
Quick Check
What is the safest way to give your server an API key?
Recap: Config & Secrets
Read settings from the environment, validate at boot, centralize in a settings object, and never commit or log secrets. Next: idempotency. 🔑
Frequently asked questions
Is the “Config & Secrets via Environment” lesson free?
Yes — the full text of “Config & Secrets via Environment” is free to read here on the web, and the MCP Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the MCP Academy course, upgrade to CoddyKit PRO.
What will I learn in “Config & Secrets via Environment”?
Load settings without hardcoding credentials. You practise MCP Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start MCP Academy?
No prior experience is required. MCP Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Config & Secrets via Environment” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this MCP Academy lesson?
Yes. Every MCP Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Layered Server Architecture
- Config & Secrets via Environment
- Idempotent, Side-Effect-Aware Tools
- Versioning Tools & Schemas