Fetching a key costs more than the twenty seconds it takes

You are writing an integration and you need a key. That means a browser, a dashboard, a login, possibly a 2FA prompt, then find the key, copy it, find the editor again, and remember what you were doing.

The twenty seconds is not the cost. The cost is that this is annoying enough to encourage the shortcut — paste the key inline "just to test it" — and inline test keys are how keys end up committed.

How it actually bites

1. The shortcut becomes the habit

   Hardcoding a value to check something works is entirely reasonable. Leaving it there because the code now works is what actually happens, and it is one git add away from permanent.

2. Regaining context takes longer than the errand

   The interruption cost of leaving an editor mid-task is well out of proportion to the errand itself. Do it six times in an afternoon and the afternoon is gone.

3. The dashboard makes you log in again

   Provider consoles expire sessions aggressively, and rightly so. It also means a twenty-second errand regularly turns into a two-minute one involving your phone.

4. You end up with a scratch file of keys

   To avoid the round trip, people keep a personal notes file with every key they use often. It is the plaintext .env problem again, but now outside any project and outside anyone’s .gitignore.

What we do about it

1. The keys are in the editor

   The VS Code extension lists your projects in the sidebar. Unlock once with your master password and the values decrypt locally, in the editor process.

2. Insert at the cursor

   Pick a key and it goes into the file where your cursor is. No browser, no clipboard, no round trip.

3. Generate the whole .env in one action

   Starting a project usually means every key at once, not one. Select the project and the extension writes the complete file.

4. A verified link when you do need the dashboard

   Creating a new key still means visiting the provider. The catalog links straight to the key-management page for each service, checked against the live page rather than guessed, so you skip the navigation.