# Keys and secrets: environment variables

> API keys and passwords open your accounts, so your app reads them from environment variables kept only in Vercel and in `.env.local` on your computer, never in your code, chat or GitHub.

## Analogy

A key is like your house key. You don't tape it to the front door (your code) or read it aloud in a café (the chat). You keep it in two safe places only.

## How it works

An env-var is a named slot, such as `TOKENTIDE_API_KEY`. Your code asks for the slot by name; the value lives outside the code.

Two homes only: Vercel (type **Secret**) for the live app, and `.env.local` for your computer. The file is listed in gitignore, so it never reaches GitHub.

You paste keys yourself, in Vercel's website or in VS Code. Your agent never asks for one and checks names, never values.

## In your project

When your app needs a key, your agent prepares `.env.local` with empty values and tells you where to paste each one. Then it runs a check that says only “set” or “missing”.

## Copy for your agent

```text
List the environment variables my app needs, where each one lives (Vercel or .env.local), and check which are set or missing, without showing any value.
```

---
Source: [Agentic Makers](https://agenticmakers.app/en/learn/keys-and-secrets) · License: CC BY 4.0