Here's a failure that can burn weeks and looks like a broken system, but is actually a working one — just not the one you wanted.
Your keys keep dying. You add a fresh API key, things work for a few hours, then everything returns 401 again. You assume it's flaky providers, a billing glitch, a bug in your code. It's none of those.
The loop, step by step
- You put your keys in a file so your code can read them — something like
data/.secrets.json. - Your automation commits it. It lives in
data/, anddata/is what gets committed. - GitHub's secret scanner finds it within hours of the push.
- The providers revoke the key automatically. This is a real program: GitHub notifies partners, and Google, AWS, Stripe, and others kill exposed credentials on their end — without asking you.
- Everything 401s. You conclude the key is “missing” or “broken.”
- You issue a new key, put it in the same tracked file, and push. Return to step 3.
That loop can run for months. It looks like instability. It's a scanner doing its job perfectly.
The fix is three lines
git rm --cached data/.secrets.json echo "data/.secrets.json" >> .gitignore git commit -m "stop tracking secrets"
Then — and this part isn't optional — rotate every key that was ever in that file. Once a secret has been pushed to a repo it's public and permanent; purging it from history does not un-publish it. Assume anything ever committed is compromised, and replace it.
The better fix
Read secrets from environment variables, never from a tracked file. And beyond that, architect for fewer secrets. Every credential you don't need is one that can't leak, expire, or be revoked. A local model with no API key can't have its API key revoked — that's not a limitation, it's the most reliable component in your stack.
This is one chapter of a bigger idea. The full $0 AI Stack guide covers building systems that need almost no secrets in the first place — pay what you want, 70% to the Palestinian Children's Relief Fund. Browse everything.