0Pricing
FastAPI Backend Development Bootcamp · Lekcja

Zarządzanie sekretami i rotacja kluczy

Ładuj sekrety ze skarbców, bezpiecznie rotuj klucze i unikaj ujawniania danych uwierzytelniających w logach lub obrazach.

Zarządzanie sekretami i rotacja kluczy to bezpłatna lekcja FastAPI Backend Development Bootcamp na CoddyKit. To lekcja 3 z 4. Możesz przeczytać całą lekcję poniżej za darmo — a potem ćwiczyć ją interaktywnie w przeglądarce z wbudowanym edytorem kodu i tutorem AI dostępnym 24/7. To część ścieżki edukacyjnej FastAPI Backend Development Bootcamp, a Twój postęp synchronizuje się między webem a aplikacją CoddyKit. Kurs FastAPI Backend Development Bootcamp zawiera 4 lekcji w sumie.

Części tej lekcji nie zostały jeszcze przetłumaczone i są wyświetlane po angielsku.

Why Secrets Need Special Handling

A secret is any value that grants access: database passwords, API keys, signing keys, OAuth client secrets. In a FastAPI backend these leak far more often than people expect.

  • Hardcoded in source and pushed to Git history forever
  • Printed into logs during debugging
  • Baked into Docker image layers
  • Echoed back in error responses or /debug endpoints

The discipline in this lesson: load secrets from a trusted source at runtime, never persist them where humans or images can read them, and rotate them on a schedule so a leak has a short blast radius.

Step 1 — Pull Config From the Environment

The baseline for any production FastAPI app is loading secrets from the environment, not from code. Pydantic's BaseSettings reads env vars (and optionally a local .env for dev) and validates them at startup.

If a required secret is missing the app fails fast on boot instead of crashing on the first request. Notice we type SecretStr so the value is masked if the object is ever printed.

from pydantic import SecretStr
from pydantic_settings import BaseSettings, SettingsConfigDict

class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file='.env', extra='ignore')

    database_url: SecretStr
    jwt_signing_key: SecretStr
    stripe_api_key: SecretStr

settings = Settings()
# Printing the model never reveals the raw value:
print(settings.jwt_signing_key)            # secret='**********'
print(settings.jwt_signing_key.get_secret_value()[:0])  # access only when needed

SecretStr Stops Accidental Logging

SecretStr is a small but powerful guard. Its __repr__ and __str__ return '**********', so the raw value never appears in logs, tracebacks, or a serialized settings dump. You must call .get_secret_value() to read the real string — an explicit, greppable action.

This standalone example shows the masking behavior without any framework.

from pydantic import SecretStr

token = SecretStr('super-secret-token-123')

# Safe: these never reveal the value
print(f'token = {token}')      # token = **********
print(repr(token))            # SecretStr('**********')

# Explicit unwrap when you truly need the value
real = token.get_secret_value()
print('length of real secret:', len(real))

Step 2 — Load From a Real Vault

Environment variables are fine, but a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault) adds auditing, access control, and built-in rotation.

The pattern is the same everywhere: authenticate with a short-lived identity, fetch the secret by name at startup, and cache it in memory. Below is AWS Secrets Manager via boto3.

import json
import boto3
from functools import lru_cache

@lru_cache(maxsize=None)
def load_secret(secret_name: str) -> dict:
    client = boto3.client('secretsmanager', region_name='eu-central-1')
    resp = client.get_secret_value(SecretId=secret_name)
    return json.loads(resp['SecretString'])

# At app startup:
# secrets = load_secret('prod/fastapi/app')
# db_url = secrets['database_url']
# Credentials come from the instance/task IAM role, NOT from env files.

Never Hardcode the Vault Credentials Themselves

A common mistake is putting the vault's own access key in the code or .env — you have just moved the problem, not solved it. Use workload identity instead:

  • AWS: IAM role attached to the ECS task / EC2 instance / Lambda
  • GCP: service account bound to the workload (Workload Identity)
  • Kubernetes: projected service-account token + IRSA / Workload Identity Federation
  • Vault: AppRole or Kubernetes auth, exchanged for a short-lived token

The golden rule: the only thing your container needs is an identity, and the platform supplies that — no long-lived key ships with the app.

Step 3 — Inject Secrets Into FastAPI Cleanly

Inside FastAPI, expose settings through a cached dependency. The @lru_cache makes get_settings() a singleton, so the vault is hit once and the object is reused. Routes depend on settings rather than reaching for globals, which also makes them easy to override in tests.

This is framework code, so it is not runnable on a plain judge.

from functools import lru_cache
from fastapi import Depends, FastAPI

app = FastAPI()

@lru_cache
def get_settings() -> Settings:
    return Settings()  # loads/validates secrets once

@app.get('/health')
def health(settings: Settings = Depends(get_settings)):
    # Use settings.database_url.get_secret_value() internally;
    # never return the secret in the response body.
    return {'status': 'ok'}

Step 4 — Rotate Keys Without Downtime

Rotation means replacing a secret with a new value on a schedule (or after a suspected leak). The hard part is doing it without dropping requests. The trick is to support two valid keys at once during the overlap window:

  • Sign new tokens with the current key
  • Verify against current OR previous key
  • After all old tokens expire, retire the previous key

This dual-key window applies to JWT signing keys, HMAC webhook secrets, and API keys alike.

Verifying JWTs Against Multiple Keys

Here is the verify-old-or-new pattern using a simple HMAC signature to stay framework-free and runnable. New tokens are signed with the current key; verification accepts either the current or the previous key during the overlap window. The same idea maps directly onto python-jose JWT keys with a kid header.

import hashlib
import hmac

CURRENT_KEY = b'key-v2-new'
PREVIOUS_KEY = b'key-v1-old'

def sign(payload: str, key: bytes) -> str:
    return hmac.new(key, payload.encode(), hashlib.sha256).hexdigest()

def verify(payload: str, sig: str) -> bool:
    for key in (CURRENT_KEY, PREVIOUS_KEY):
        if hmac.compare_digest(sign(payload, key), sig):
            return True
    return False

old_token_sig = sign('user=42', PREVIOUS_KEY)
new_token_sig = sign('user=42', CURRENT_KEY)
print('old still valid:', verify('user=42', old_token_sig))
print('new valid:', verify('user=42', new_token_sig))
print('tampered:', verify('user=99', new_token_sig))

Key IDs Make Rotation Auditable

Tag each key with a key id (kid) so a token announces which key signed it. Verification looks up the matching key instead of trying all of them, and you can revoke a single kid the moment it leaks. JWTs carry the kid in the header; this standalone example shows the lookup logic.

import hashlib
import hmac

KEYS = {
    'k2': b'current-secret',
    'k1': b'previous-secret',
}
ACTIVE_KID = 'k2'

def issue(payload: str) -> dict:
    key = KEYS[ACTIVE_KID]
    sig = hmac.new(key, payload.encode(), hashlib.sha256).hexdigest()
    return {'kid': ACTIVE_KID, 'payload': payload, 'sig': sig}

def check(token: dict) -> bool:
    key = KEYS.get(token['kid'])
    if key is None:
        return False  # revoked / unknown kid
    expected = hmac.new(key, token['payload'].encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, token['sig'])

t = issue('order=7')
print('issued with kid:', t['kid'])
print('valid:', check(t))
t['kid'] = 'k0'  # pretend signed by a revoked key
print('after revoke:', check(t))

Step 5 — Keep Secrets Out of Logs

Even with SecretStr, you can still leak via custom log lines, request dumps, or exception messages. Defend in depth with a logging filter that redacts known patterns (tokens, bearer headers, connection strings) before records are emitted.

This filter is standalone and runnable.

import logging
import re

SECRET_RE = re.compile(r'(Bearer\s+)[A-Za-z0-9._-]+|(password=)[^\s&]+')

class RedactFilter(logging.Filter):
    def filter(self, record: logging.LogRecord) -> bool:
        msg = record.getMessage()
        record.msg = SECRET_RE.sub(r'\1\2[REDACTED]', msg)
        record.args = ()
        return True

logger = logging.getLogger('app')
logger.addHandler(logging.StreamHandler())
logger.addFilter(RedactFilter())
logger.setLevel(logging.INFO)

logger.info('calling api with Authorization: Bearer abc123tok')
logger.info('db dsn password=hunter2 host=db')

Step 6 — Don't Bake Secrets Into Images

Docker images are layered and shippable; anything in a layer is recoverable with docker history even if a later layer deletes it. So secrets must never enter the build.

  • Do not COPY .env or pass secrets via ARG/ENV at build time
  • Inject at runtime via the orchestrator (env from a secret store, mounted file, or sidecar)
  • For build-time needs (private package install) use BuildKit --mount=type=secret, which never persists in a layer
  • Add .env and key files to .dockerignore and .gitignore

Verify with docker history --no-trunc <image> — no secret should appear in any layer.

Quick Check

You must rotate the JWT signing key of a live FastAPI API without invalidating tokens that users are still carrying. Which approach achieves zero-downtime rotation?

Recap — Secrets Management and Key Rotation

You now have a full defense chain for backend secrets:

  • Load secrets from the environment or a vault at runtime; validate on startup with BaseSettings and wrap values in SecretStr
  • Authenticate to the vault with workload identity (IAM role / service account), never a hardcoded key
  • Inject via a cached FastAPI dependency, and never echo secrets in responses
  • Rotate with a dual-key overlap window and a kid so old tokens stay valid and any key is independently revocable
  • Redact secrets in logs with a logging filter and SecretStr masking
  • Exclude secrets from Docker layers; inject at runtime and verify with docker history

Minimize where secrets live, keep them short-lived, and make every access explicit and auditable.

Często zadawane pytania

Czy lekcja „Zarządzanie sekretami i rotacja kluczy” jest bezpłatna?

Tak — pełny tekst „Zarządzanie sekretami i rotacja kluczy” jest dostępny za darmo tutaj w sieci. Aby ćwiczyć ją interaktywnie (wbudowany edytor kodu i tutor AI dostępny 24/7) i odblokować resztę kursu FastAPI Backend Development Bootcamp, przejdź na CoddyKit PRO. Kurs FastAPI Backend Development Bootcamp zawiera 4 lekcji w sumie.

Co nauczysz się w „Zarządzanie sekretami i rotacja kluczy”?

Ładuj sekrety ze skarbców, bezpiecznie rotuj klucze i unikaj ujawniania danych uwierzytelniających w logach lub obrazach. Ćwiczysz FastAPI Backend Development Bootcamp z praktycznym kodem, który uruchamiasz bezpośrednio w przeglądarce, a tutor AI dostępny 24/7 odpowiada na Twoje pytania podczas pracy nad lekcją.

Czy potrzebuję doświadczenia, aby zacząć FastAPI Backend Development Bootcamp?

Nie wymagamy żadnego doświadczenia. FastAPI Backend Development Bootcamp w CoddyKit jest strukturyzowany dla początkujących i zaawansowanych użytkowników, więc możesz zacząć tutaj lub od początku i uczyć się w swoim tempie. To lekcja 3 z 4.

Ile czasu zajmuje lekcja „Zarządzanie sekretami i rotacja kluczy”?

Większość lekcji CoddyKit trwa około 5–10 minut. Każda lekcja to mały, interaktywny krok, dzięki czemu robisz systematyczne postępy i zawsze wracasz dokładnie do tego samego miejsca — na webie i w aplikacji.

Czy mogę pisać i uruchamiać kod w tej lekcji FastAPI Backend Development Bootcamp?

Tak. Każda lekcja FastAPI Backend Development Bootcamp zawiera wbudowany edytor kodu, więc piszesz i uruchamiasz prawdziwy kod bezpośrednio w przeglądarce i od razu otrzymujesz sprzężenie zwrotne od AI — bez konfiguracji na komputerze.

Wszystkie lekcje w tym kursie

  1. Ograniczanie 10 najważniejszych zagrożeń bezpieczeństwa API według OWASP
  2. Ograniczanie częstotliwości żądań i ochrona przed nadużyciami botów
  3. Zarządzanie sekretami i rotacja kluczy
  4. CORS, CSP i zasady bezpiecznych nagłówków
← Powrót do FastAPI Backend Development Bootcamp