API key

And one I wanted to bring up that actually just came out in the last week or so, as we're recording this, was that OpenCode got hacked.

And what they did was they got in and stole all the API keys for open AI and perplexity, you know, anthropic.

So they were running up charges and using other people's API keys.

It was on their dime and a lot of people didn't know about it.

So that was a huge hack that people were having to come out of pocket for a bunch of money when they didn't, you know, like what happened here? And so part of that is, okay, we've got data in the hands of other people.

And like I said, these API keys, they're like the keys to your excavator sitting there without them.

We need to lock them up.

And that's one thing I want to talk about today.

And then it went ahead and told me one thing that I know I'm gonna have to change.

When Alex and I made these websites, we hard coded our API keys right into the site, which means that anyone can see them and anyone can try to use them.

So it's already given me, uh, recommendations.

I don't wanna look at that use yet.

But the way I do that is I have a bunch of quotes in a, my SQL database that it pulls from randomly.

So let's do a new scan real quick and do all the stuff.

Now I still have one big problem and that's my API keys.

Currently they are plain text right in the stinking middle of my code that anyone can see you visit that website.

And again, you have the same problem, like you don't know... what the rotation is or anything like this.

I mean, basically, API Keys is totally caveman, right? And that's what a lot of vendors, I think Okta is another one that really annoys me, which doesn't have a very clean relationship.

So, the minute you're dealing with API Keys, you're just setting up yourself for disaster, right? It makes all the security stuff that you want to do so much harder.

That's true.

I mean, overall, it was a big rant about Cloudflare being not very user-friendly, but at the same time, Cloudflare has an amazing, I think, new paradigm in the way that you build and deploy or run infrastructure.

So I'm not sure you can do that with Bitbucket.

But yeah, zero trust in an agent age in the age of agents is probably i mean it was already a pattern that everyone should adopt but you know how many companies are actually you know sharing vpn profiles uh even when somebody left the company they can still log into the vpn and and sharing you know long-lived credentials that's still such a you know i i

just want to get i i want to get away from I spent hours messing around with API keys yesterday.

Organizations need to maintain ongoing visibility into the security posture of their partners.

This includes contractual requirements for timely breach notification, regular security audits, and clear processes for responding to incidents that originate outside your direct control.

Moving to North Flank, we've seen a breach that resulted in unauthorized use of AI API keys.

Northflank responded by urging customers to rotate their secrets immediately.

This incident highlights a growing risk in cloud-native and AI-integrated environments, the compromise of API keys.

As organizations increasingly rely on APIs to connect services and enable automation, these credentials become high value targets.

Secret management, meaning the secure creation, storage, rotation, and revocation of API keys and other credentials must be a top priority.

Rapid incident response protocols are crucial.

So pip install dash dash upgrade, just in case, let's install Gradio.

you can do this in a million different ways if you want to build your own kind of chat ui have at it it's just gradio has a chat element already for us it's super easy and quick to use so that's what i'm going to do instead so this was a kind of part of me wants to just do this in a separate script i think that's what i'm going to do okay to start we're going to import gradio as gr and then we're going to import open ai as well we're going to open ai dot api key equals open i'm just going to copy and paste what we had above here

this

Okay, so once we've got that, we're going to make a chatbot, but instead, I think what I'd like to do is make it a joke chatbot, so some sort of customized chatbot.

And that means you could just spin up a Fable agent and just let it run for 12 hours while you're sleeping.

And when you wake up, that's several thousand dollars on one API key.

Yep.

Yeah, API keys saved to open code workspaces may have been exposed after someone accessed a legacy system.

Users are reporting unexpected spending on connected AI accounts, with one putting the damage at $400.

Yep, and

And Fractal, here's the thing.

You can self-host OpenCloud.

Yeah.

so um and key and those those api keys are essentially passwords that's right yeah the the private key at least

yeah the the public private key pair is you know a form of a password um so that's that's now available so then you'd have to re-key it and then again where are you going to save that that information And why do you need to? So a lot of the issues with development and around security is, you know, if we have such powerful tools now, we could do anything.

But if we don't have that basic understanding of security, we can get ourselves into trouble pretty quickly.

So over here, it says ElevenLabs not connected.

So what we need to do is we need to grab the API key from ElevenLabs.

So what we're gonna do is we're gonna head over to ElevenLabs, and we're gonna go out the bottom left corner, Developers, and then go on API Keys.

We're gonna go over here, Create Key, and then we're gonna call this Claude Code, and then just give access to all of this stuff.

Like, monthly, unlimited limits.

Not just the theory, but the actual step-by-step process.

I'm going to walk you through getting an API key, making your first call, handling the responses, and honestly building something you can actually use.

Whether you're a developer who's been putting this off, or you're just curious about how this stuff works under the hood, you're going to leave with a working example.

And look, even if you're not technical, stick around because I'm going to show you what to look for when AI features start popping up in the tools you use every day.

OpenAI has made the documentation clearer, the error handling better, and honestly, the whole process is way more straightforward than it was even six months ago.

But you still need to know what you're doing, and here's what I keep seeing.

People get excited about these price drops, they sign up for an API key, they make a few test calls, and then nothing.

They don't actually build anything useful because they don't know how to move from hello world to something that actually solves a problem.