Is GitIgnore OK (API keys)?

[pythonmegapixel]

I'm writing an application which requires an API key. However, I also want to make this open source and push it to a public Git repository.

Obviously I don't want to give my API key out publicly.

 

My plan is to store the key in a file called secret.txt which will be read in at runtime, and add secret.txt to the .gitignore file before committing to the repo.

 

Is that a safe way of hiding it or do I need to something more to make sure others can't get a hold of it?

[vorticalbox]

normally you would save these in a .env file then load them into your environment before starting your application.

 

for node i use env-cmd, for python i use python-dotenv. You didn't say what language you are using but this is a common pattern and there should be some module to help you out

 

https://www.npmjs.com/package/env-cmd

https://pypi.org/project/python-dotenv/

[pythonmegapixel]

1 minute ago, vorticalbox said:

normally you would save these in a .env file then load them into your environment before starting your application.

 

for node i use env-cmd, for python i use python-dotenv. You didn't say what language you are using but this is a common pattern and there should be some module to help you out

This doesn't answer the question though. If I just put .env in the .gitignore file, is that sufficient security to prevent the key from accidentally reaching the public repository, or do I have to do something else?

[vorticalbox]

3 minutes ago, pythonmegapixel said:

This doesn't answer the question though. If I just put .env in the .gitignore file, is that sufficient security to prevent the key from accidentally reaching the public repository, or do I have to do something else?

yes.

[duncannah]

You can still stage ignored files using the -f flag, something to keep in mind

[botto]

So just covering some basics, files you are about to commit are called staged files, so when you do a `git commit -m "Hello world"` you will be creating a new change with the staged files.

 

Entries in the `.gitignore` file will prevent you from staging those files. So if you put `.env` file name in your `.gitignore` you won't stage it, however I can't speak for git gui tools and how they work, like @duncannahyou can force stage a file.

 

Usually before I commit work I check what is staged, you can do this with `git status` so if you see your `.env` file is staged, then you can unstage the file with `git reset .env`.