To directly answer your two questions:

1. The secret keys are stored external to the source code so that they are not commit to revision control.
2. The secret key isn't created by exporting the environment variable, nor is it created using the value in the environment variable.

The information you probably are really after:

First, keep in mind that I am not a cryptology expert! With that out of the way…

What you need to do is to generate some secret of appropriate size and cryptographic security for your application, then set the environment variable to be that value.

I'm making a guess that the secret key is being used in relation with the flask.ext.login.make_secure_token method of the Flask-Login module you linked to. If this is the case, looking at the source code, the key is being used with HMAC for a SHA-512. Ideally, the key should be the same as the blocksize used by the algorithm which, in this case, as indicated by the source for the Python 2.7 hmac implementation is 64 for 512-bit HMAC. If the key is smaller than the blocksize, it will be padded with zeros; if larger, it will hashed down to the blocksize.

The Flask quickstart documentation section for sessions provides an example backed up by Python's os.urandom documentation for generating crytographically suitable random bytes to use for the secret key. I would alter their example as we want a key for a blocksize of 64, rather than 24, to be:

import os
os.urandom(64)

Take the result of that and set the environment variable to the value. Using the Flask example directly (don't use these values for your code):

>>> import os
>>> os.urandom(24)
'\xfd{H\xe5<\x95\xf9\xe3\x96.5\xd1\x01O<!\xd5\xa2\xa0\x9fR"\xa1\xa8'

You would take the output, and set the environment variable to that value:

export BLOGFUL_SECRET_KEY='\xfd{H\xe5<\x95\xf9\xe3\x96.5\xd1\x01O<!\xd5\xa2\xa0\x9fR"\xa1\xa8'

Get the random string for secret key:

Method 1: Use os in Python 2/3:

>>> import os
>>> os.urandom(12)
'\xf0?a\x9a\\\xff\xd4;\x0c\xcbHi'

Method 2: Use uuid in Python 2/3:

>>> import uuid
>>> uuid.uuid4().hex
'3d6f45a5fc12445dbac2f59c3b6c7cb1'

Method 3: Use secrets in Python >= 3.6:

>>> import secrets
>>> secrets.token_urlsafe(16)
'Drmhze6EPcv0fN_81Bj-nA'
>>> secrets.token_hex(16)
'8f42a73054b1749f8f58848be5e6502c'

Method 4: Use os in Python 3:

>>> import os
>>> os.urandom(12).hex()
'f3cfe9ed8fae309f02079dbf'

Set secret key in Flask

Method 1: Use app.secret_key:

app.secret_key = 'the random string'

Method 2: Use app.config:

app.config['SECRET_KEY'] = 'the random string'    

Method 3: Put it in your config file:

SECRET_KEY = 'the random string'

Then load the config form config file:

app.config.from_pyfile('config.py')  # if your config file's name is config.py

python-dotenv actually has nothing to do with Flask. It is for your .env file to be translated into actual env variables. So if you're going to have actual env variables without it, your os.getenv should still work.

Sidenote: You can also use os.environ:

os.environ.get("SECRET")

I'm on my phone and I've never used Webfaction but a quick search showed that it doesn't seem trivial to set environment variables there.

What I suggest instead is that you load sensitive configuration values from a separate file that you don't check into version control.