How to HIDE Your API Keys in Python Projects

Never commit your API keys or other sensitive data to github again! Keep it neat and tidy by hiding your api key using one of these 2 methods. Both work and have their uses, but I'd lean towards using the .env file to store your own environment variables. It's easy to recreate this file on your server or anywhere else you need to run your project without having to change any code inside.

Support Me:

-------------------------------------
Disclaimer: These are affiliate links and as an Amazon Associate I earn from qualifying purchases
-------------------------------------

[AdobadoFantastico]

Straightforward, concise, and clear. Much appreciated.

[phoenix]

Clear, short, on point, extremely useful . Thank you.

[stifferdoroskevich]

Very nice video!
Its simple, but very important thing to do in projects...

[chetancc]

Hi John,
Found it useful. Tried it today and it worked. Thanks for your time and sharing.
Thanks,
Chetan from Kandivali, Mumbai, India :)

[bx_h]

Thank you – this length of a video is great!

[eziola]

Great video! You showed us how to read a .env variable into a python module. Next would be how do I set or write to or update a .env variable from my python module? This is something I have to do with refresh tokens. I have to read the last refresh token from the .env file, get a new refresh token back, and save the new refresh token back into the .env variable. Hopefully that make sense! It would be amazing to know how to do that!

[goheugene]

Was watching your videos and because of your clear explanations, I did my first python Api scrapper with extremely little knowledge of programming 🤣🤣

I was wondering if you will be doing any video on some sites that has a slider as a captcha like Alibaba as it seems impossible to scrape

[Ezraielshayan]

the correct recent syntax is:
os.environ.get('api_key')
or
os.environ['api_key]

[multigladiator]

We had the same problem with user credentials. I suggested to extract them from code-files into a json file and add it to the .gitignore file.
Then simply import it in the files where you need the credentials and voila...
One downside: People have to manually create the credentials json. But I think thats a question of perspective. It kind of adds to safety in my opinion.

[BernalynBiscocho]

Sir, can you explain more on how to replicate the env on any server? Like to deploy in the production. Do I need to do it on every pc?

[alexportugal]

Now what I don't get is what if i want to use the project in another computer? How do i get the api_key when I don't have it in github?

[AB-cdgd]

Is it safe enough if i put the api in golang and compiled to a dll then i import it with ctypes

[mabdurrafeyahmed]

The first way does not work after compiling the executable. The program always uses the same keys irrespective of what is in the creds file. Best way is to use config files.

[Gaamaa-ozeflfn]

One doubt:
Are you taking about only the server base projects where already all are safe.
But what about client based standalone applications.
The binary is on client's system. If some one disassemple they could see the .env file right ?
As it is Python is not safe to right commercial projects, because 100% source code can be retrived.

[santiagootero]

what about the .env file when launching the webste? isnt it vulnerable for malisious users whoose purpouse is to get the api keys?

[kevon]

Exactly what i was looking for, thanks!

[irinamicov]

Thanks for the tip. Works like a charm!

[igoresposito]

Very good explanation, I have a question for you, what theme used in terminal? zsh?

[beastvirus]

Please make a video on how to make the API paid that I you build to scrape data from somewhere. It should tell us how to put a limit on itl

[dingding]

But how would one automate this?
I don't want to manually create a file on the server everytime.
Any way that works well when working with Docker images and CICD?