Twelve clients, and their keys must never meet
Client credentials are borrowed, not owned. Mixing them up is a professional problem before it is a technical one.
- The setup
- Independent developer. Several concurrent clients, each with their own provider accounts.
- In play
- Client-owned provider accountsPer-client projectsFixed-term engagements
Every client hands over credentials to their own accounts. You are holding property that belongs to someone else, usually with no written process for how you store it and no defined end date for when you stop.
The two failure modes are opposite: using client A’s key in client B’s project, and still having client A’s key two years after the engagement ended.
What breaks
One flat .env directory invites cross-contamination
Twelve .env files with the same variable names in twelve sibling directories. Copying a config from the last project is normal, and it is exactly how the wrong key ends up live.
Nothing marks the end of an engagement
The invoice is paid, the repository is handed over, and the keys stay in a folder on your machine indefinitely. Nobody asked for them back because nobody tracked that you had them.
Clients ask how you store their credentials
Increasingly this is a question in the contract, and "in a .env file on my laptop" is not an answer that wins the work.
How it works here
Hard separation by project
Each client is a project with its own keys and, when shared, its own data-encryption key. There is no shared namespace for a variable name to collide in.
Encrypted at rest, with a real answer for the contract
AES-256-GCM with a key derived from a master password we never receive. When a client asks, the /security page documents the actual construction, including what the server can still see.
Deleting a project ends it
When an engagement closes, delete the project. The stored ciphertext goes with it, rather than a directory quietly persisting through three laptop migrations.
Generate per client, on demand
The .env exists while you work on that client and not otherwise, which removes the copy-the-last-config habit that causes the mix-ups.
Closest to your setup?
Install the extension, import an existing .env, and check the fit against your own projects. It works offline and nothing is uploaded unless you sign in.