Where your keys live

Where this sits. Immediately before the first lesson that creates a credential.

In the next lesson you create a key, and it will be on your screen for a few seconds before it is gone. After that, nobody can show it to you again, including the company that issued it. That is deliberate, it is good security, and it is the piece of this whole course most likely to cost you an afternoon.

Which is why this arrives now, while you have nothing to lose, instead of in twenty minutes when you do.

Why this gets a lesson of its own

Over the next few lessons you create keys with three properties worth knowing about in advance.

• They spend money. An AI key bills you every time your agent thinks. Somebody else holding it spends your money on their own schedule, and you find out when the invoice arrives.
• They read your business. A payments key can see your revenue. A calendar token can read your calendar. Read-only is still your data, and it still has your clients' names in it.
• Changing your password does nothing to them. A key lives on its own, separately from the login that made it. The fix for a leaked one is to go and revoke it, and you can only revoke the keys you remember creating.

All three of those are handled by one habit, and the habit is having a single place you put things, set up before you have anything to put in it.

The thing everybody learns the hard way

Most services show you a key exactly once.

You click Create, a long string appears, and that is the only time you will ever see it. Come back tomorrow and the page shows you a name, a date, and a row of dots. Cloudflare works this way with the secrets you hand your agent. So do most of the services you will connect to it later. This catches people who write software for a living, several times a year. The design does that to everybody.

The moment a key appears on screen, put it somewhere safe before you click anything else. Before the setup is finished, before you have checked whether it works, while it is still sitting there on the screen.

Losing one is survivable. You delete it and make another, which takes about a minute. What takes the afternoon is finding every place the old key was in use and updating them all, and you find those one at a time, by discovering what broke, usually starting with the one your client noticed first.

Pick somewhere to put them

Use a password manager. If you already have one, use that and skip the rest of this section.

If you do not, 1Password is the one I use and LastPass is the other name you will come across. Either is fine. The differences between them will not matter to you. Having one will.

Places to keep them out of, and this is worth being fussy about:

• A note in your notes app, which syncs to every device you own and is searchable by anything with access to that account
• A document called keys.txt on your desktop, which is the first place anyone would look and the second place you would forget about
• Your own inbox, because email is the most-breached surface most people own, and a key in a sent message is a key sitting on somebody else's server as well as yours
• A message thread with anybody, including the one you have with yourself

How to store them so they are useful in four months

The common mistake is storing the key and nothing else. Four months later you find a sixty-character string and have no idea what it opens or what stops working if you delete it.

Make one entry per key, with four things in it.

That third line is the one that saves you. When a key needs replacing, it tells you exactly what to update, instead of leaving you to work it out by watching things fail in an order you did not choose.

The rule that matters most

Never paste a key into a chat with an AI assistant. Not Claude, not ChatGPT, not any of the others, and not even to ask what is wrong with it.

You will be tempted, because you will hit an error at 10pm and want to show somebody. Describe the error instead. "My key starts with sk- and I get a 401" is enough for any assistant to work with, and it keeps a live credential out of a conversation you no longer control. (Same goes for screenshots. Crop them.)

Three more rules, and then this lesson is done.

• One key per thing you build, rather than one key shared across several. If it leaks, you revoke one agent instead of every agent you own.
• If you think a key leaked, revoke it now and make a new one. Do not wait until you are sure. Revoking costs two minutes and replacing it costs two more.
• The passwords you invent for your own agents go in the same place. That password is the only thing standing between your agent's address and anyone who guesses it.

✅ Before you move on

• A password manager installed, and one you can actually open
• Nothing in it yet, which is exactly right
• You know the habit, which is that a key gets saved the moment it appears, before the next click
• Dropped a question or a win in the group. Both are useful, and somebody else is on this exact step today

The first entry arrives in the next lesson, and by then you will already know where it goes.