A heather-honey coop pasted the storage account key into appsetting…

Question

A heather-honey coop pasted the storage account key into appsettings.json checked into source control. How should the developer construct the Azure Blob Storage v12 client instead?

Accepted Answer

Build the client with DefaultAzureCredential (or a TokenCredential) or a connection string loaded from a secret store — Keys in source are like leaving the warehouse master key under the doormat in a public photo. Prefer DefaultAzureCredential / TokenCredential, or pull a connection string from Key Vault or another secret store—not from git.

Answer

Keep the account key in source and rotate it only when a PR review fails

Answer

Hard-code a SAS token that never expires as a public class constant

Answer

Use QueueClient with the account key so Blob uploads inherit security

A heather-honey coop pasted the storage account key into appsettings.json checked into source control. How should the developer construct the Azure Blob Storage v12 client instead?

Short Explanation

Full Explanation