# Hardcoded secret

Canonical page: /glossary/hardcoded-secret

API keys & secrets glossary, Mistakes & leaks. Hardcoded Secret: Why It's the Riskiest Way to Store a Key

**Short answer:** A hardcoded secret is an API key, password, or token written directly into a program's source code, rather than loaded from an environment variable or a secrets manager at runtime. Anyone who can read the source, including through version control history, can read the secret.

## Why it matters

Hardcoding is often the fastest way to get something working, which is exactly why it is common in scripts and prototypes, and exactly why it needs to be cleaned up before that code is shared or committed anywhere.

## In Claude Keychain

Claude Keychain gives you an alternative that is nearly as fast as hardcoding: instead of pasting a key into a script, you save it once and reference it by name, and Claude Code retrieves the real value only at the moment it is needed.

## Common questions

**Is hardcoding a secret ever acceptable?**

Only in something that will never be shared, committed, or run outside a fully trusted, temporary context, and even then it is a habit worth avoiding.

**How do I find hardcoded secrets in an existing project?**

Secret scanning tools search a codebase and its git history for patterns that look like keys or tokens.

## Related

[Secret leaked in git history](/glossary/secret-in-git-history), [Secret scanning](/glossary/secret-scanning), [API key](/glossary/api-key)