How to Safely Store API keys in Python 🔑
When I started to be honest I published my API key’s on GitHub as didn't want to bother to add .gitignore to a particular file or write a separate .py script that will handle just that. As you will expand on your projects you will encounter higher usage of different API services.
Where to store them
As I started to create more complex projects I started to separate script’s based on their actions. When it comes to API key’s the case is no different I would suggest to create a config directory and add your config.py and a API file that will store the actual keys.
Clean architecture and project structure is increasing in importance the more you scale and add functionalities.
ALERT: Don’t forget to add config/.env in your .gitignore for unwanted commits/pushes!
Create your constant script
As you probably noticed in the screenshot above I have decided to store my API key’s in .env file. There are other options(which I do not recommend) I will talk about in my YouTube video that will be provided here.
What my .env contains as a example 👇
weatherAPI=apikeyWeather
cryptoAPI=apikeyCrypto
stockAPI=apykeyStock
APIKey=apikeyTwitter
APIKeySecret=apikeyTwitterSecret
BearerToken=apikeyTwitterBearer
AccessToken=apikeyTwitterAccess
AccessTokenSecret=apikeyTwitterAccessSecretWe start by importing the os, dotenv and dataclasses modules.
Use the load_dotenv(find_dotenv()) to find the .env file in local config directory. Data Classes are becoming more of a default for Python and rightfully so.
The frozen=True specifies that the values are immutable.
In the created class will create str variables and using os.getenv(‘Apikey’) we assign the value to it.
//stock.py
from config.config_files import APIkeysURL = "your_url" + APIkeys.stockAPIIt’s important though to run the script from the main script as otherwise if having similar code architecture structure as I have provided in the first screenshot will resort in ModuleNotFound error.
Concluding
As more and more companies integrate API’s, storing them separate from main code logic and making them immutable should be a priority. Same as not committing to GitHub what never should be there in the first place.
Related Stories
More content at PlainEnglish.io. Sign up for our free weekly newsletter. Follow us on Twitter, LinkedIn, YouTube, and Discord.
