Skip to content
MyDSHMy DSH Field Notes
中文
Independently maintained; not affiliated with DeepSeek. No association with mydsh.dev or other MyDSH sites.

Home/Models, permissions & security/API keys & credentials

Keep the key in an environment variable, not a config file

About to sync config to another machine, or put the config directory in a backup or repo, and the key could ride along.

VerifiedVersion and environmentChecked 2026-11-14
Host version
0.1.2-alpha.5
Measured file
~/.dsh/.credentials.yaml
Checked
2026-11-14

Copyable command

dsh --dump-config | grep -i -A3 model

First, the reality. The local credentials file looks like this (values masked):

version: 1
refs:
  DEEPSEEK_API_KEY: <your key>
records:
  client-connection/browser-session:
    kind: grant
    payload:
      version: 1
      secret: <session secret>

The key under refs is plaintext, not a reference to a secret store. So treat the file as the key itself: out of repos, out of public backups, never sent to someone to debug.

Why use an environment variable anyway

  • Backup granularity: the config worth keeping is tens of megabytes. With the key in the environment, that archive can be passed around freely; with the key in a file, every archive needs hand-picking.
  • Multiple machines: environment variables are per machine, so syncing config does not carry the key.

How to set it

export DEEPSEEK_API_KEY='sk-...'        # current shell
echo 'export DEEPSEEK_API_KEY=...' >> ~/.bashrc   # persistent; mind file permissions

In Windows PowerShell it is $env:DEEPSEEK_API_KEY = "sk-..."; persist with [Environment]::SetEnvironmentVariable.

Not absolute security: same-user processes can read it, and ps e can surface it on some systems. It solves 'config got synced away', not 'the machine was compromised'. Not encryption.

Verify it took effect

dsh --dump-config | grep -i -A3 model

If the dump shows a reference rather than a literal key, the path is right. Then run a file-reading task to confirm end to end.

What counts as working

Check every line. All of them pass or the job is not done.

  • No literal key appears in dump-config
  • The read-file task still works, proving the key is picked up
  • An archive of the config alone contains no key

Where it fails

Symptom, cause, what to do — written in the order it actually happens.

SymptomCauseWhat to do
The variable is set but dsh cannot see itDifferent shell or session; the child did not inherit itStart dsh in the same shell; on Windows check user versus process scope
The credentials file already holds a plaintext keyWritten earlier; an environment variable does not clear itReplace with a reference or delete the line, and treat that key as exposed — rotate it

Sources

Verified means measured here. Compiled means every line carries a source.

Other topics in this group

Back to this group All topics