2

I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into git with those details still accessible.

Note: I am new to Python and I want to understand what would be good practice.

Another question: Is there an easy way to help user replace my API credentials with his set of credentials?

Improve this question
4
  • 1
    Are you targeting a specific platform? Are you using normal python or something like IronPython?
    – John
    Commented Mar 16, 2016 at 17:34
  • In general, I don't think this question fit under Information Security. This is more appropriate for Stack Overflow. I asuume you are developing your project using a python framework (e.g. Django, Flask, etc) you are using?
    – Ubaidah
    Commented Mar 16, 2016 at 17:37
  • I initially posted it on stackoverflow and was directed here. I am using a python ide. In my program, I will be using the Reddit API and currently have a separate file from which the py file takes in the credentials. I was wondering whether there was a better way to handle this.
    – mantrarush
    Commented Mar 16, 2016 at 19:01
  • Not really, it is a credential and it must be stored somewhere. Using a configuration file is the most common way to do that.
    – Ubaidah
    Commented Mar 17, 2016 at 1:32

3 Answers 3

Reset to default
4

A possible way to achieve this is to have an optional configuration file - that is not in the repository but handled separately from the source code - from which those values are read.

You may include a demo configuration with placeholders in the repo for release though.

Also, with such a way, it will be easy to modify for users for different deploy targets.

Improve this answer
2

I will try with Environment Variables because this way you don't have any problem committing any of the credentials to your version control system. 

import os
print(os.environ['SECRET'])
Improve this answer
2
  • What if the machine shuts down unexpectedly?
    – Limit
    Commented Apr 11, 2018 at 21:40
  • Then your monitoring service should see that and respawn the node, or the machine, or VM. I am going to assume that you are using docker or any other container technology for your production deployments and I strongly recommend you to look into Kubernetes.
    – Alejandro Serret
    Commented Apr 12, 2018 at 2:37
1

First of all do not hardcode the credentials in the source code :).

If your problem is limited to the git. Then, you can store the credentials in a configuration file and then add this file to your gitignore file. When you push the code with git the configuration file with the credential will not be push to your remote git repo

Improve this answer
2
  • This method is becoming generally invalid via the Docker/etc "etherial" servers. Each time our code is pushed a new instance of the app is made, the old one goes away. The config will not be there. Additionally, we don't really have FTP/similar access. The instance pulls in GIT...magic. Config was a great solution until 3-5 years ago when slices became the norm.
    – Marc
    Commented Oct 25, 2016 at 15:40
  • @datamafia I am not sure what are you talking about. The question does not ask about CI or CD and definitely, was not about docker containerization.
    – Ubaidah
    Commented Oct 25, 2016 at 21:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .