A guide to properly managing API keys and environment variables in Python projects
When working with APIs in Python, you often need to use API keys or other sensitive credentials. It's crucial to manage these keys securely to avoid leaking sensitive information or accidentally committing them to your Git repository.
For a complete demonstration, check out my GitHub repository Secure-API-Key-Handling, It features a Streamlit chat app that securely manages API keys using .env files and the python-dotenv package while interacting with the Gemini Generative AI model.
Follow these steps to set up your project for secure API key handling:
You'll need the python-dotenv package to load environment variables from a .env file.
pip install python-dotenv
Create a .env file in your project root, where you'll store your API key and other environment-specific variables:
# .env API_KEY=your_api_key_here
Important: This .env file should never be committed to your repository. We’ll configure .gitignore to ensure that.
Add the following line to your .gitignore file to ensure that .env doesn't get pushed to Git:
# .gitignore .env
For other developers working on your project, include a .env.example file as a template:
# .env.example API_KEY=your_api_key_here
This file will not contain sensitive data, but it gives an example of the variables required to run the project. Other developers can copy this file to .env and add their own credentials.
cp .env.example .env
# BAD EXAMPLE: Never do this api_key = "hardcoded_api_key"
Committing .env files : Ensure that .env is always included in .gitignore to avoid accidentally pushing it to version control.
Pushing Virtual Environments: Always exclude virtual environments (like venv) from Git:
# .gitignore venv/
以上是Secure API Key Handling in Python Projects的详细内容。更多信息请关注PHP中文网其他相关文章!