Environment variables without key confusion

Lesson 5 / 22 · Commentail 1.3.2

YOUR_API_KEY is a placeholder, not a usable credential. Obtain your value from the selected service and replace the value only. Keep the variable name RESEND_API_KEY: Python uses that name to find it.

Know which value you have

Both CAPTCHA keys must belong to the same resource and supported widget type. A mail key cannot substitute for a CAPTCHA key.

Set values in your terminal

In a local macOS/Linux terminal:

export RESEND_API_KEY='YOUR_API_KEY'
export DEFAULT_FROM_EMAIL='Comments <comments@YOUR_VERIFIED_DOMAIN>'
export CAPTCHA_SITE_KEY='YOUR_SITE_KEY'
export CAPTCHA_SECRET_KEY='YOUR_SECRET_KEY'

In PowerShell:

$env:RESEND_API_KEY = 'YOUR_API_KEY'
$env:DEFAULT_FROM_EMAIL = 'Comments <comments@YOUR_VERIFIED_DOMAIN>'
$env:CAPTCHA_SITE_KEY = 'YOUR_SITE_KEY'
$env:CAPTCHA_SECRET_KEY = 'YOUR_SECRET_KEY'

Keep the address brackets: the format is Name <address>. Replace YOUR_VERIFIED_DOMAIN with your mail provider's verified domain. If you are only configuring CAPTCHA, the mail variables are unnecessary at this step.

Read values in Django

Use import os and os.environ["RESEND_API_KEY"] in settings. Square brackets deliberately fail when a required value is missing. A KeyError naming the variable means the process did not receive it; do not fix that by hard-coding the secret in Python.

Check presence without printing the credential:

python -c "import os; print('RESEND_API_KEY:', bool(os.environ.get('RESEND_API_KEY')))"

True means the string is nonempty, not that it is valid. The placeholder YOUR_API_KEY is also nonempty, so a delivery test remains necessary.

Pass values to the running site

Terminal variables reach processes started from that terminal. They do not automatically reach another open terminal, cron, a container or a systemd service. On a server, use your hosting panel's Environment/Secrets settings or the existing service's protected environment file. Restart both the website and the worker, using the same database and settings module.

Django does not load .env automatically. Follow an existing loader's format if your project already uses one; otherwise use the terminal commands for these lessons. Do not add a second loader just for the examples. Keep secret files outside public directories and Git, readable only by the owning user/service. Revoke and replace a leaked key; deleting the text does not revoke access.

After experimenting, remove the test CAPTCHA and revoke the dedicated test mail key. Confirm that the live site uses a different resource before deleting anything.

Related lessons

• 6. Send email through SMTP
• 7. Use the Resend API through Django Anymail
• 9. Connect Google reCAPTCHA
• 10. Connect Yandex SmartCaptcha

Related documentation

• Callbacks
• Email-and-worker