HTTPS and Keys
- Terminology and concepts to look out for: HTTPS · encryption · API key
- Relevance to me: Code Coach sends your question across the internet, and the model it uses costs money to run. Today you learn how both are protected.
- Board Question: A browser says "Connection is secure" for a site. What does that tell you, and what does it not tell you? Give one of each.
Open the discussion form on the right and answer Section 1 from your first reading.
HTTPS, Encryption and API Keys
This section explains how data is protected while it travels between a browser and a server, and why the key that pays for a service is never written in a web page.
What Encryption Does
On a shared network, such as public wifi, other people can capture data as it travels. Encryption is a way of scrambling data so that only the intended receiver can read it. First, the sender uses an encryption key, a set of values that both sides agree on, to change readable data into data that appears random. Next, the scrambled data travels across the network, and then the receiver, who has the right key, turns it back into readable data. For example, a sentence that anyone could read becomes a string of characters that means nothing without the key.
Encryption is often confused with compression, because both change a file before it is sent. A compressed file is smaller, but it is not hidden from anyone. All modern browsers support the same few compression methods, so any browser can open a compressed file. Compression is not encryption, because it makes data smaller without keeping anyone from reading it.
What HTTPS Protects and What It Does Not
Browsers and websites send data using a set of rules called HTTP. HTTPS is the way a browser and a server send data to each other with encryption. In Chrome, the icon at the left of the address bar opens a panel, and on a site that uses HTTPS the panel says "Connection is secure." That message means the connection uses HTTPS. If someone on the same network captures the data, it appears as meaningless characters. HTTPS also confirms which server the browser is talking to, so the data goes to the site named in the address.
HTTPS protects data while it travels, but it does not make a site's information true. A site with a secure connection can still give wrong information, and its owners can still be dishonest. The team that builds Chrome reported that nearly all phishing sites, which are fake sites made to trick people, use HTTPS. Google's help page for Chrome advises people to be careful with personal information even on secure sites. For example, a page of homework answers can arrive over HTTPS and still be full of mistakes, because HTTPS protects the trip and does not check the content.
Why an API Key Stays on a Server
Many programs use services on another company's computers, such as a language model. An API is a set of rules that lets one program use another program or service. An API key is a secret string that identifies who is making requests to a service. The service uses the key to track each request and to bill the account it belongs to. Whoever has the key can use that account and spend its budget. An API key is not an encryption key, because it does not scramble anything. Mistral, the company whose model Code Coach uses, tells developers never to commit API keys to a repository.
Everything in a page is sent to the browser, including the HTML, the CSS and the JavaScript. Anyone who opens a page can read its JavaScript, so an API key is kept on a server and never written in the page. Google's guide to API keys gives the same rule for any code that runs in a browser. The page sends its request to a server, and the server adds the key before passing the request on.
Code Coach works this way, as Figure 1 shows. The bench page sends a student's question to the class endpoint, which is a server. The endpoint adds the key and passes the request on to the model. The key is stored on the endpoint as a secret setting, and it never appears in any file a browser receives. The excerpt below is copied from the code the B18 bench page loaded on October 19, 2026.
fetch("/api/class/ask",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({tool:c.trim(),system:"You are Code Coach.
The excerpt names the endpoint's address and contains no key. The class endpoint's address is in the page, and anyone can read it. The API key is a secret, and it is never in a file that a browser receives. The address does not reveal the key, and the endpoint accepts only requests that carry a valid course code, up to 12 Code Coach requests for each student in a class period.
Summary
Encryption scrambles data so that only the intended receiver can read it, and HTTPS uses encryption to protect data while it travels between a browser and a server. A secure connection does not show that a site's information is true or that the site is honest. An API key identifies an account and lets its holder spend the account's budget, so it is kept on a server such as the class endpoint and never written in a page, where anyone could read it.
Sources: Cloudflare, What is encryption? (n.d.); MDN, Compression in HTTP (2026); Cloudflare, What is HTTPS? (n.d.); Chromium, page_info_strings.grdp (n.d.); Chromium Blog, post of May 2 (2023); Google, Check if a site's connection is secure (n.d.); MDN, Glossary: API (2025); OWASP, Secrets Management Cheat Sheet (n.d.); Google Cloud, Manage API keys (n.d.); Mistral AI, Manage workspaces and API keys (n.d.); MDN, How the web works (2026); Google Cloud, Best practices for managing API keys (2026); CS I class endpoint code and saved B18 page excerpt (2026).
-
notebook cue: HTTPS
A site's connection is secure, and the site gives wrong information. Is that possible? Why?
Check
Yes, it is possible. HTTPS protects data while it travels between the browser and the server, but it does not make a site's information true, and nearly all phishing sites use HTTPS. See What HTTPS Protects and What It Does Not, paragraph 2.
-
notebook cue: encryption
Someone on the same wifi captures the data the bench page sends to Code Coach. With HTTPS, what do they see?
Check
They see scrambled data that appears as meaningless characters, because encryption changes the data so that only the intended receiver, the class endpoint, can read it. They cannot read the code or the question. See What Encryption Does, paragraph 1, and What HTTPS Protects and What It Does Not, paragraph 1.
-
notebook cue: API key
Where is Code Coach's API key stored, and which part of the system adds it to a request?
Check
The key is stored on the class endpoint as a secret setting, and the endpoint, a server, adds it before it passes the request on to the model. The bench page never has the key. See Why an API Key Stays on a Server, paragraph 3, and Figure 1.
-
notebook cue: HTTPS
A site's connection is secure, and the site gives wrong information. Is that possible? Why?
Check
Yes, it is possible. HTTPS protects data while it travels between the browser and the server, but it does not make a site's information true, and nearly all phishing sites use HTTPS. See What HTTPS Protects and What It Does Not, paragraph 2.
-
notebook cue: encryption
Someone on the same wifi captures the data the bench page sends to Code Coach. With HTTPS, what do they see?
Check
They see scrambled data that appears as meaningless characters, because encryption changes the data so that only the intended receiver, the class endpoint, can read it. They cannot read the code or the question. See What Encryption Does, paragraph 1, and What HTTPS Protects and What It Does Not, paragraph 1.
-
notebook cue: API key
Where is Code Coach's API key stored, and which part of the system adds it to a request?
Check
The key is stored on the class endpoint as a secret setting, and the endpoint, a server, adds it before it passes the request on to the model. The bench page never has the key. See Why an API Key Stays on a Server, paragraph 3, and Figure 1.
HTTPS, Encryption and API Keys
This section explains how data is protected while it travels between a browser and a server, and why the key that pays for a service is never written in a web page.
What Encryption Does
On a shared network, such as public wifi, other people can capture data as it travels. Encryption is a way of scrambling data so that only the intended receiver can read it. First, the sender uses an encryption key, a set of values that both sides agree on, to change readable data into data that appears random. Next, the scrambled data travels across the network, and then the receiver, who has the right key, turns it back into readable data. For example, a sentence that anyone could read becomes a string of characters that means nothing without the key.
Encryption is often confused with compression, because both change a file before it is sent. A compressed file is smaller, but it is not hidden from anyone. All modern browsers support the same few compression methods, so any browser can open a compressed file. Compression is not encryption, because it makes data smaller without keeping anyone from reading it.
What HTTPS Protects and What It Does Not
Browsers and websites send data using a set of rules called HTTP. HTTPS is the way a browser and a server send data to each other with encryption. In Chrome, the icon at the left of the address bar opens a panel, and on a site that uses HTTPS the panel says "Connection is secure." That message means the connection uses HTTPS. If someone on the same network captures the data, it appears as meaningless characters. HTTPS also confirms which server the browser is talking to, so the data goes to the site named in the address.
HTTPS protects data while it travels, but it does not make a site's information true. A site with a secure connection can still give wrong information, and its owners can still be dishonest. The team that builds Chrome reported that nearly all phishing sites, which are fake sites made to trick people, use HTTPS. Google's help page for Chrome advises people to be careful with personal information even on secure sites. For example, a page of homework answers can arrive over HTTPS and still be full of mistakes, because HTTPS protects the trip and does not check the content.
Why an API Key Stays on a Server
Many programs use services on another company's computers, such as a language model. An API is a set of rules that lets one program use another program or service. An API key is a secret string that identifies who is making requests to a service. The service uses the key to track each request and to bill the account it belongs to. Whoever has the key can use that account and spend its budget. An API key is not an encryption key, because it does not scramble anything. Mistral, the company whose model Code Coach uses, tells developers never to commit API keys to a repository.
Everything in a page is sent to the browser, including the HTML, the CSS and the JavaScript. Anyone who opens a page can read its JavaScript, so an API key is kept on a server and never written in the page. Google's guide to API keys gives the same rule for any code that runs in a browser. The page sends its request to a server, and the server adds the key before passing the request on.
Code Coach works this way, as Figure 1 shows. The bench page sends a student's question to the class endpoint, which is a server. The endpoint adds the key and passes the request on to the model. The key is stored on the endpoint as a secret setting, and it never appears in any file a browser receives. The excerpt below is copied from the code the B18 bench page loaded on October 19, 2026.
fetch("/api/class/ask",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({tool:c.trim(),system:"You are Code Coach.
The excerpt names the endpoint's address and contains no key. The class endpoint's address is in the page, and anyone can read it. The API key is a secret, and it is never in a file that a browser receives. The address does not reveal the key, and the endpoint accepts only requests that carry a valid course code, up to 12 Code Coach requests for each student in a class period.
Summary
Encryption scrambles data so that only the intended receiver can read it, and HTTPS uses encryption to protect data while it travels between a browser and a server. A secure connection does not show that a site's information is true or that the site is honest. An API key identifies an account and lets its holder spend the account's budget, so it is kept on a server such as the class endpoint and never written in a page, where anyone could read it.
Sources: Cloudflare, What is encryption? (n.d.); MDN, Compression in HTTP (2026); Cloudflare, What is HTTPS? (n.d.); Chromium, page_info_strings.grdp (n.d.); Chromium Blog, post of May 2 (2023); Google, Check if a site's connection is secure (n.d.); MDN, Glossary: API (2025); OWASP, Secrets Management Cheat Sheet (n.d.); Google Cloud, Manage API keys (n.d.); Mistral AI, Manage workspaces and API keys (n.d.); MDN, How the web works (2026); Google Cloud, Best practices for managing API keys (2026); CS I class endpoint code and saved B18 page excerpt (2026).
Each table agrees on one thing "Connection is secure" means and one thing it does not mean.
Chromebooks stay closed while your table talks. Sections 1 and 2 of the discussion form are already done. After you talk, finish Section 3 right here under My View. Submit before the exit ticket.
This form has three sections. Section 1: answer today's Board Question. Section 2: after the reading. Section 3 opens later in class. Today's Board Question: A browser says "Connection is secure" for a site. What does that tell you, and what does it not tell you? Give one of each.
CR 1. Board Question: A browser says "Connection is secure" for a site. What does that tell you, and what does it not tell you? Give one of each. Give your answer and one reason.
Write your answer in your lab notebook, labeled CR 1.
MC 1. Think about your answer to the board question. A browser says "Connection is secure" for a site. What does that tell you, and what does it not tell you? Give one of each. Which position is closest to yours now?
- It means the site is safe and its information can be trusted.
- It means data is encrypted on the way. It says nothing about whether the site is honest.
- It means the site has no ads and no viruses.
MC 2. (Reading claim 1) Anything written in a page's code can be read by a person who opens the page.
- Agree
- Disagree
MC 3. (Reading claim 2) HTTPS checks that the information on a site is correct.
- Agree
- Disagree
MC 4. (Reading claim 3) A secret that a program needs should be kept on a server.
- Agree
- Disagree
MC 5. (Reading claim 4) In Figure 1, the API key travels with the request from the bench page to the class endpoint.
- Agree
- Disagree
MC 6. (Reading claim 5) A compressed file is smaller, but any browser can open it, so compression does not hide the data.
- Agree
- Disagree
MC 7. (Reading claim 6) Anyone who opens the bench page can read the class endpoint's address.
- Agree
- Disagree
MC 8. (Reading claim 7) A site that shows "Connection is secure" cannot be a phishing site.
- Agree
- Disagree
MC 9. (Reading claim 8) Whoever has an API key can use the account it belongs to and spend its budget.
- Agree
- Disagree
CR 2. (A different view) Write the view at your table that was most different from yours. If everyone agreed, write the strongest argument against your table's answer.
Write your answer in your lab notebook, labeled CR 2.
CR 3. Think about the Board Question again: A browser says "Connection is secure" for a site. What does that tell you, and what does it not tell you? Give one of each. Do you have the same opinion as when you first answered the board question? If it is the same, what from the reading or table talk reaffirmed your opinion? If it is different, what from the reading or table talk changed your opinion?
Write your answer in your lab notebook, labeled CR 3.