What Vibe Coding Is (and Isn't) · Lesson 3
7 minKeep Secrets Secret
Goal: Tell a public key from a secret key, and store secrets in environment variables that never reach the browser or your Git history.
0%
ReadStep 1 of 6
Keys are like keys
In plain English
A public key is like your shop's street address: it's fine if everyone sees it. A secret key is like the key to the safe: if someone copies it, they can take everything.
Services give you keys so your app can talk to them:
| Kind | Example name | Can it go in the browser? |
|---|---|---|
| Publishable / public | VITE_CLERK_PUBLISHABLE_KEY, VITE_SUPABASE_PUBLISHABLE_KEY | Yes, it's designed for that |
| Secret | CLERK_SECRET_KEY, SUPABASE_SECRET_KEY, STRIPE_SECRET_KEY | Never |
Anything in your front-end code (the part that runs in the browser) can be read by anyone who opens your site. Secret keys belong only on a server.
Quick check: Who can see a key that's inside your front-end code?