I am in the planning stages of creating a rmarkdown website and publishing it using Github pages. The actual content of the website will be a flexdashboard or a Shiny app(still deciding). Regardless, I want to be able to use publicly available APIs in this application. Some of these APIs require public and private (or secret) keys to access. I obviously would prefer to not have my secret keys displayed in the source code on Github. Is there a way around this that does not involve purchasing a private Github account? I am sure people have run into this issue in the past, but I have not been able to find a sufficient answer. I am not well-versed to application security whatsoever, so any help would be appreciated.

  • 1
    this is really a question for GitHub support or GitHub Pages forums – schroeder Oct 30 '17 at 19:46
  • @schroeder my mistake. Was a little unsure if this was correct place for my question. You can delete or put on hold or whatever – Kyle Weise Oct 30 '17 at 21:02

GitHub Pages is designed for hosting public websites, and it's great at doing that. But as soon as you want to start keeping certain things private, it falls apart as an option pretty quickly. Even if you have a private repo, GitHub will still serve all the files to the public - no authentication needed.

For this sort of situation, you want to use something other than GitHub Pages. Which service specifically is not in scope here, but any hosting service that gives you a bit more control will work; you'll just need to run the Jekyll build process yourself and then publish the resulting HTML to your host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.