How bad is it to run Flask without a secret key?
As long as sessions are not used, Flask won't complain and there is no need for a secret key.
When a secret key is needed, Flask will crash at runtime if none is provided.
There is no security risk with providing no secret key in the sense of the concern expressed in the question (Flask lowering security due to the missing key). The worst that can happen is seeing the application crash at runtime.
I'm using Flask to build a REST API.
I noticed that it didn't complain when I launched the app with no secret_key. Even in production mode.
I thought Flask used to complain in this case. Maybe I'm confused with another warning.
Anyway, what could be the consequences?
Can this trigger exceptions at runtime?
The API doesn't use sessions at all, so I don't see what it could need a secret key for.