I am in the planning stages of creating a rmarkdown website and publishing it using Github pages. The actual content of the website will be a flexdashboard or a Shiny app(still deciding). Regardless, I want to be able to use publicly available APIs in this application. Some of these APIs require public and private (or secret) keys to access. I obviously would prefer to not have my secret keys displayed in the source code on Github. Is there a way around this that does not involve purchasing a private Github account? I am sure people have run into this issue in the past, but I have not been able to find a sufficient answer. I am not well-versed to application security whatsoever, so any help would be appreciated.
GitHub Pages is designed for hosting public websites, and it's great at doing that. But as soon as you want to start keeping certain things private, it falls apart as an option pretty quickly. Even if you have a private repo, GitHub will still serve all the files to the public - no authentication needed.
For this sort of situation, you want to use something other than GitHub Pages. Which service specifically is not in scope here, but any hosting service that gives you a bit more control will work; you'll just need to run the Jekyll build process yourself and then publish the resulting HTML to your host.