How to safely store API keys in a GitHub project? #188310
Replies: 10 comments 2 replies
-
|
The short answer: never store API keys directly in your repository, especially in a public one. Here are the safest and most common approaches: 1️⃣ Use GitHub Secrets (Best for projects using GitHub Actions) If your project uses CI/CD, store your API keys in Repository Secrets: Repository → Settings → Secrets and variables → Actions → New repository secret Then reference them in your workflow: env: Secrets are encrypted and never exposed in logs (unless you explicitly print them). 2️⃣ Use Environment Variables (Best for local development) Store keys in environment variables instead of hardcoding them. Example: .env file (do NOT commit this): API_KEY=your_key_here Add .env to your .gitignore so it never gets pushed. Then load it in your app (depending on your language/framework). 3️⃣ Use Environment Protection (For production deployments) If deploying via GitHub, use Environment Secrets with protection rules. 4️⃣ If You Accidentally Commit a Key Immediately: Revoke/regenerate the key from the provider. Remove it from Git history. Rotate credentials. Never assume deleting the file is enough — Git history keeps it. |
Beta Was this translation helpful? Give feedback.
-
|
The "Gold Standard" for Securing API Keys on GitHub
Create a .env file: Store your keys here locally (e.g., STRIPE_KEY=sk_test_51...). Update .gitignore: Immediately add .env to your .gitignore file. This tells Git to never track this file, ensuring it never leaves your machine. Create a .env.example: Commit a template file (e.g., STRIPE_KEY=your_key_here) so other contributors know which variables they need to set up without seeing your actual values.
Go to your repository Settings > Secrets and variables > Actions. Add a New repository secret. These are encrypted and can only be accessed by your code at runtime—they are never visible in the clear. In your workflow YAML, reference them like this: API_KEY: ${{ secrets.MY_API_KEY }}.
Go to Settings > Code security and analysis. Ensure Secret scanning and Push protection are enabled. If you accidentally try to commit a known secret format (like an AWS or Google Cloud key), GitHub will block the push before it reaches the server, saving you from a potential leak. What if I already committed a key? Revoke/Rotate: Treat the key as compromised. Deactivate it immediately in your provider's dashboard (e.g., OpenAI, AWS). Scrub History: Use a tool like git-filter-repo or BFG Repo-Cleaner to remove the secret from every past commit in your repository's history. Force Push: You will need to force-push the cleaned history to GitHub (git push --force). |
Beta Was this translation helpful? Give feedback.
This comment was marked as off-topic.
This comment was marked as off-topic.
-
|
Never store API keys directly in your code or commit them to a public repo. The best approach is: Store them in environment variables Keep them in a local .env file Add .env to your .gitignore so it never gets pushed In production, use your hosting provider’s secret manager (GitHub Actions Secrets, Vercel/Netlify env vars, AWS Secrets Manager, etc.) Example: .envAPI_KEY=your_secret_key_here Then access it in your app via environment variables instead of hardcoding it. This keeps your keys secure and out of version control |
Beta Was this translation helpful? Give feedback.
-
|
The safest pattern is: never commit secrets to Git (even “temporarily”), and load them at runtime from a secure source. Here are practical options, from simplest to more “production-grade”: 1) Local development:
|
Beta Was this translation helpful? Give feedback.
-
|
The best way to keep your API keys secure is never to store them directly in your code, especially if your repository is public. Here are the recommended practices:
By following these practices, you can keep your API keys safe and prevent unauthorized access. |
Beta Was this translation helpful? Give feedback.
-
|
Never commit API keys to the repo (public or private). Treat them like passwords. Recommended setup (small project → production): Put secrets in a local file like .env and add it to .gitignore: Commit an example file instead: CI/CD: GitHub Actions Secrets Production: use a secret manager (best practice) Hardening If a key was ever committed |
Beta Was this translation helpful? Give feedback.
-
|
✅ Best practice Use environment variables and keep secrets out of Git history.
Put keys in a .env file: API_KEY=your_key_here Add .env to .gitignore so it never gets pushed. Load it in your app (example Node.js): import 'dotenv/config'; Repo → Settings → Secrets and variables → Actions Add a secret like API_KEY Use it in your workflow: env: If the key is in browser code, it’s not truly “secret”. Use a backend (or serverless function) to call the API and keep the real key server-side.
Revoke/rotate it immediately, then remove it from the repo history (and don’t reuse it). |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
bro in your project folder create a .env file and keep all the API keys there and then create a .gitignore file and in that keep it like this Environment variables.env and you can able to store them in the public repository without exposing them |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Select Topic Area
Question
Body
I am working on a small project and I want to keep my API keys secure.
What is the best way to store them without exposing them in a public repository?
Beta Was this translation helpful? Give feedback.
All reactions