33

I am building a system that uses API tokens and keys to access services, but where is the best place to store them? I want to push the code to GitHub without pushing the tokens.

Currently, I've placed them in a blank file named Constants.py and, in the main python file, I import Constants.py.

API_KEY_SERVICE = "ABC123ABC"

Main.py:

import Constants
service_key = Constants.API_KEY_SENDGRID
3
  • 4
    One option is read these constants from environment variables. That way you won't have any secrets in your source code. Commented Jul 11, 2019 at 18:32
  • 4
    As a first shot you should add the file to .gitignore to prevent accidental commits and pushes.
    – Klaus D.
    Commented Jul 11, 2019 at 18:32
  • Another is using a yaml file and adding the .yaml to .gitignore.
    – Niloct
    Commented Jul 11, 2019 at 18:33

4 Answers 4

22

What you are attempting is the correct way to segregate sensitive information from code. You should include the constants.py in your .gitignore file which will prevent git from tracking that file and thus not pushing it to github.

For .gitignore, refer: https://git-scm.com/docs/gitignore

14

There are a few options:

  1. Store it locally as you have and, as Sebastin Santy noted, add constants.py to your .gitignore file.

  2. Store it as an environment variable if you're using a conda virtual environment. Virtual environments aren't stored; the requirements for creating one are in the requirements.txt file. You can find more on the steps from the conda documetation

  3. Use the OS module

  4. If you have more than one set of environment variables, you might consider using decouple

  5. If you're using AWS, you'll want to store the (what would be third party) keys in their own area with its own IAM. There are two ways recommended by AWS.

2
  • 3
    I like that you included AWS in your answer but im curious why you didnt mention AWS Secrets Manager?
    – BilliD
    Commented Nov 25, 2021 at 20:17
  • 2
    @BilliD - No, you're right. That was an oversight. Thanks for pointing it out.
    – hrokr
    Commented Aug 31, 2022 at 17:18
6

There are some good answers here. To add to them, I think we can also use the keyring module, which will read the credentials from Windows credentials or Mac OS keychain. But I would love to hear the thoughts of the community. Thanks.

here's the link to that - https://pypi.org/project/keyring/

0

Please allow me to add more to the environment variables approach, which is not limited to conda virtual environment. One can use a .env file, and place it in the root directory of your project. Meanwhile, you should include .env in the .gitignore file.

What makes this approach different compared to using constants.py, especially for those who do not subscribe a Key Management Service?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.