I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into git with those details still accessible.

Note: I am new to Python and I want to understand what would be good practice.

Another question: Is there an easy way to help user replace my API credentials with his set of credentials?

  • 1
    Are you targeting a specific platform? Are you using normal python or something like IronPython? – John Mar 16 '16 at 17:34
  • In general, I don't think this question fit under Information Security. This is more appropriate for Stack Overflow. I asuume you are developing your project using a python framework (e.g. Django, Flask, etc) you are using? – Ubaidah Mar 16 '16 at 17:37
  • I initially posted it on stackoverflow and was directed here. I am using a python ide. In my program, I will be using the Reddit API and currently have a separate file from which the py file takes in the credentials. I was wondering whether there was a better way to handle this. – mantrarush Mar 16 '16 at 19:01
  • Not really, it is a credential and it must be stored somewhere. Using a configuration file is the most common way to do that. – Ubaidah Mar 17 '16 at 1:32

A possible way to achieve this is to have an optional configuration file - that is not in the repository but handled separately from the source code - from which those values are read.

You may include a demo configuration with placeholders in the repo for release though.

Also, with such a way, it will be easy to modify for users for different deploy targets.

| improve this answer | |

First of all do not hardcode the credentials in the source code :).

If your problem is limited to the git. Then, you can store the credentials in a configuration file and then add this file to your gitignore file. When you push the code with git the configuration file with the credential will not be push to your remote git repo

| improve this answer | |
  • This method is becoming generally invalid via the Docker/etc "etherial" servers. Each time our code is pushed a new instance of the app is made, the old one goes away. The config will not be there. Additionally, we don't really have FTP/similar access. The instance pulls in GIT...magic. Config was a great solution until 3-5 years ago when slices became the norm. – Marc Oct 25 '16 at 15:40
  • @datamafia I am not sure what are you talking about. The question does not ask about CI or CD and definitely, was not about docker containerization. – Ubaidah Oct 25 '16 at 21:47

I will try with Environment Variables because this way you don't have any problem committing any of the credentials to your version control system.

import os
| improve this answer | |
  • What if the machine shuts down unexpectedly? – Limit Apr 11 '18 at 21:40
  • Then your monitoring service should see that and respawn the node, or the machine, or VM. I am going to assume that you are using docker or any other container technology for your production deployments and I strongly recommend you to look into Kubernetes. – Alejandro Serret Apr 12 '18 at 2:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.