Hacker News Reader

What's the best way to handle api keys without storing them in a repository? A separate configuration file?

I've saved api keys to a repository, but only ones with no payment information attached and read only access. Mainly because I couldn't think of a better way at the time.

View on HN

Usally in environment variables rather than a config file.

for example https://devcenter.heroku.com/articles/config-vars

This is very convenient on Heroku, but on my own servers, I have to use a post-deploy hook to copy a file that has all of my API keys to the server. That works great, except I now have a separate file to manage outside of source control, it's not under its own source control, and it's difficult to share amongst my team.

Anyone have any suggestions?

I've had some luck with having a separate repo. I'll have a "public" (even if it's not public) with all of the usual source code, and a "private" repo, with passwords, fabric files, run scripts, etc.

Works well on teams, where the subset of developers that don't need to do actual deployments don't need the private repo anyway.

Reply on news.ycombinator.com