Bringing Cloudflare in from the cold
Everything on AWS here runs on credentials that last minutes. Cloudflare I'd been clicking by hand, and bringing it in meant living with a long-lived secret and making it as small as I could.
Tags
4 pages
Credentials
Secrets that scrub themselves from RAM
Storage answers where a secret lives, not what happens to it in memory. Wrapping secrets so they redact in Debug and zero on drop.
The blank import that keeps a dependency out of your binary
Making OS-keychain support provably absent from a Go binary for regulated or air-gapped builds, using a registry and a blank import.
Where should a CLI keep your API keys?
Credential storage for a Go CLI: an env-var reference by default, an opt-in OS keychain, and plaintext only as a last resort and banned in CI.
