Secrets and Environment Variables Checklist for Automation Stacks
AI automation systems often use API keys, database passwords, webhook secrets and service tokens. If secrets are handled badly, one leak can expose your workflows, data, billing account or infrastructure.
Core principle
Secrets should be separated from public code, limited in permission, rotated when exposed and backed up securely enough for recovery.
Checklist
- List every API key and token used by the stack.
- Store secrets in .env or a secure config method.
- Do not commit secrets to public repositories.
- Use separate keys for production and testing.
- Limit permissions when the provider supports it.
- Rotate keys if a webhook or file is leaked.
- Avoid printing secrets in logs.
- Back up .env securely.
- Document which service uses which secret.
- Remove unused keys from providers.
Reusable lesson
Secrets management is not only for large companies. Even a small n8n or AI agent stack can create real cost and security risk if keys are leaked.
When to Use This Checklist
Use this checklist when running n8n, Docker, AI agents, API workers or webhook automation with API keys and service tokens.
Required Tools
Docker Compose, .env files, API provider dashboards, server access, private backup location, logs
Before You Start
Before deployment, decide where secrets will live and who or what is allowed to read them.
Structured Checklist Steps
- List all secrets.
- Store secrets outside public code.
- Use .env or secure config.
- Separate production and test keys.
- Limit permissions.
- Rotate leaked keys.
- Prevent secrets in logs.
- Back up .env securely.
- Document secret ownership.
- Delete unused keys.
Verification Steps
- No secret is hardcoded in public content.
- Production and test keys are separate.
- Logs do not reveal tokens.
- Unused keys are removed.
- Recovery copy exists securely.
Rollback Plan
If a secret is exposed, revoke or rotate it immediately, update the server environment and review logs for possible abuse.
Common Mistakes
- Putting API keys in public GitHub repos.
- Sharing webhook URLs with tokens.
- Using one key everywhere.
- Logging full request payloads with secrets.
- No record of which workflow uses which key.
Related Commands
cat .env
docker compose config
grep -R "sk-" .
grep -R "API_KEY" .
docker logs container_name --tail 100