Keeping API keys secret in Gatsby
I am not a security expert and make no promises that this will hack proof your app. I do know you should NEVER commit secret keys to github
- Open
.gitignore
and ignore*.env
. You should probably ignore this in a global .gitignore file
secret files
Create a .env file in your apps main directory
code .env
Add as many secrets to your new .env file as you need. Something like:
SECRET_KEY=sk_T2BDZFh2BE57DZFhGn0qlXGhiQK
`ANOTHER_KEY=srahateinrshnthnrasht374678'Add to gatsby-node.js
1require("dotenv").config({2 path: `.env.${process.env.NODE_ENV}`,3})45...6// import keys something like7`secretKey: process.env.SECRET_KEY,`8`anotherKey: process.env.ANOTHER_KEY,`