I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into git with those details still accessible.

Note: I am new to Python and I want to understand what would be good practice.

Another question: Is there an easy way to help user replace my API credentials with his set of credentials?

  • 1
    Are you targeting a specific platform? Are you using normal python or something like IronPython?
    – John
    Mar 16, 2016 at 17:34
  • In general, I don't think this question fit under Information Security. This is more appropriate for Stack Overflow. I asuume you are developing your project using a python framework (e.g. Django, Flask, etc) you are using?
    – Ubaidah
    Mar 16, 2016 at 17:37
  • I initially posted it on stackoverflow and was directed here. I am using a python ide. In my program, I will be using the Reddit API and currently have a separate file from which the py file takes in the credentials. I was wondering whether there was a better way to handle this.
    – mantrarush
    Mar 16, 2016 at 19:01
  • Not really, it is a credential and it must be stored somewhere. Using a configuration file is the most common way to do that.
    – Ubaidah
    Mar 17, 2016 at 1:32

3 Answers 3


A possible way to achieve this is to have an optional configuration file - that is not in the repository but handled separately from the source code - from which those values are read.

You may include a demo configuration with placeholders in the repo for release though.

Also, with such a way, it will be easy to modify for users for different deploy targets.


I will try with Environment Variables because this way you don't have any problem committing any of the credentials to your version control system.

import os
  • What if the machine shuts down unexpectedly?
    – Limit
    Apr 11, 2018 at 21:40
  • Then your monitoring service should see that and respawn the node, or the machine, or VM. I am going to assume that you are using docker or any other container technology for your production deployments and I strongly recommend you to look into Kubernetes. Apr 12, 2018 at 2:37

First of all do not hardcode the credentials in the source code :).

If your problem is limited to the git. Then, you can store the credentials in a configuration file and then add this file to your gitignore file. When you push the code with git the configuration file with the credential will not be push to your remote git repo

  • This method is becoming generally invalid via the Docker/etc "etherial" servers. Each time our code is pushed a new instance of the app is made, the old one goes away. The config will not be there. Additionally, we don't really have FTP/similar access. The instance pulls in GIT...magic. Config was a great solution until 3-5 years ago when slices became the norm.
    – Marc
    Oct 25, 2016 at 15:40
  • @datamafia I am not sure what are you talking about. The question does not ask about CI or CD and definitely, was not about docker containerization.
    – Ubaidah
    Oct 25, 2016 at 21:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .