I interact with some API's that use PKA and I'm looking for the safest / best-practice way to store my secret key. The approaches I know are for example:
- Create a
0500access directory on my server
- Within that directory, store the file containing the secret key in plain text as a
- Access and use the key on the localhost server via
- Store the secret key in plain text via the
.htaccessfile of the server, via:
SetEnv HTTP_MY_VARIABLE "my value"
And then access and use the value via $_ENV.
Note that the
.htaccess file eventually has something like
0644 access rights, which is why I prefer the first strategy to be safer.
What's your guess? Is there an even better way?