pythonapi-keybearer-token

Best Practices Python - Where to store API KEYS/TOKENS

I am building a system that uses API tokens and keys to access services, but where is the best place to store them? I want to push the code to GitHub without pushing the tokens.

Currently, I've placed them in a blank file named Constants.py and, in the main python file, I import Constants.py.

API_KEY_SERVICE = "ABC123ABC"

Main.py:

import Constants
service_key = Constants.API_KEY_SENDGRID
Solution

  • What you are attempting is the correct way to segregate sensitive information from code. You should include the constants.py in your .gitignore file which will prevent git from tracking that file and thus not pushing it to github.

    For .gitignore, refer: https://git-scm.com/docs/gitignore