The key theme for this week is shaping a repeatable environment and introducing secure secret management. This will help shift the experience from orientation to personalization. Why is this important now? Because small customizations help build trust and confidence.

Featured REST API Endpoints

• List available machine types for a repository: GET /repos/{owner}/{repo}/codespaces/machines
• List machine types for a codespace: GET /user/codespaces/{codespace_name}/machines
• Update a codespace: PATCH /user/codespaces/{codespace_name}
• Export a codespace: POST /user/codespaces/{codespace_name}/exports
• Get export details: GET /user/codespaces/{codespace_name}/exports/{export_id}
• User secrets lifecycle:
  • List secrets: GET /user/codespaces/secrets
  • Get public key: GET /user/codespaces/secrets/public-key
  • Create or update secret: PUT /user/codespaces/secrets/{secret_name}
  • Delete secret: DELETE /user/codespaces/secrets/{secret_name}
  • Manage selected repositories (add/remove)

Micro-Tasks

1. List machine types and note memory + CPU differences; choose a smaller one intentionally.
2. Create or update a user secret (e.g., API_TOKEN) via the public key encryption workflow.
3. Confirm the secret is present inside a running codespace (echo $API_TOKEN if set through environment).
4. Export a codespace and fetch export details until status is “completed.”
5. Update a codespace to a different machine type and measure a build time difference.

15-Minute Stretch Activity

Write a script:

• Fetch public key
• Encrypt a dummy secret (like “hello-world-token”)
• Create/update the secret
• List secrets to verify

Security Mindset Shift

Secrets live in a scoped store—avoid placing them in devcontainer.json or committing them. The API lets you audit what exists without downloading values.

What’s one tiny customization (machine type, extension, secret) that made your environment feel more “yours,” and why?