Proper way to hide API keys in Git

Question

In my C# project have APIKeys.cs file which have const strings with API keys. I want those strings to be empty in Git server but have actual API keys in my local computer. So peoples who pull project can compile it without problem and still my local computer gonna have API keys in same file.

If I try to upload APIKeys.cs file with empty strings then I can't have local file with API keys because when I try to push it, it will overwrite empty APIKeys.cs file. Also I can't ignore this file too because it will remove empty APIKeys.cs file from Git server.

So what is best automated approach for this problem which will allow class file with empty strings in server, so project will be compileable when people pull it and have real class file in local computer?

Unfortunately there is no automatic way to do this (that I know of). You might have to just remove the file from the staging area every time you commit. — Simon Whitehead
– Simon Whitehead, Commented Feb 14, 2014 at 9:03

Jaex · Accepted Answer · 2018-02-13 14:55:37Z

20

I figured another solution now which is not perfect but still good enough for me, example:

APIKeys.cs file:

public static partial class APIKeys
{
    public static readonly string ImgurClientID = "";
    public static readonly string ImgurClientSecret = "";
    public static readonly string GoogleClientID = "";
    public static readonly string GoogleClientSecret = "";
    public static readonly string PastebinKey = "";
    ...
}

APIKeysLocal.cs file:

public static partial class APIKeys
{
    static APIKeys()
    {
        ImgurClientID = "1234567890";
        ImgurClientSecret = "1234567890";
        GoogleClientID = "1234567890";
        GoogleClientSecret = "1234567890";
        PastebinKey = "1234567890";
        ...
     }
}

Ignore APIKeysLocal.cs file in Git and people who don't have this file can still be able to compile project if they remove this file from solution explorer.

I also automatically create empty APIKeysLocal.cs file if it is not already exists using project pre build event:

cd $(ProjectDir)APIKeys\

if not exist APIKeysLocal.cs (
    type nul > APIKeysLocal.cs
)

That way user don't need to do anything to be able to compile project.

edited Feb 13, 2018 at 14:55

answered Feb 16, 2014 at 16:30

Jaex

4,3242 gold badges36 silver badges58 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

reddtoric Over a year ago

I like this solution. One thing: Why would did you create an empty APIKeysLocal.cs file when it isn't needed to compile? I don't know much about pre-build events but if instead, it built a local file based off of a template that also had empty strings in the constructor for others to fill, then that would make more sense. Then others can see how your local file is setup and do the same.

Sewmina Dilshan Jan 9 at 8:20

Protip for public repos, keep a copy of this file with empty fields in a different name if the repo is going to be public.

Community · Accepted Answer · 2017-05-23 12:18:02Z

12

Accept that you cannot hide unencrypted private keys in a public space.

What you can do is move the keys to a private space, and then reference that private space from code.

Your private space might be environment variables or the Windows registry, it should be something outside the source code of your app.

Another approach is to create a new config file (e.g. keys.config) specifically for storing private keys, and then exclude this file from source control.

This means you don't share your private keys, but it also means that you need to document (perhaps in readme.md) that users will need to recreate their own keys.config. Even better (thanks @Joey) is to include a sample config file (keys.sample.config) in the solution, illustrating what's needed.

Here is an example

edited May 23, 2017 at 12:18

CommunityBot

11 silver badge

answered Feb 14, 2014 at 9:17

Ed Guiness

35.5k16 gold badges114 silver badges149 bronze badges

4 Comments

Joey Over a year ago

I usually use the config file approach and include a foo.config.sample in source control which then can be copied to foo.config where the actual keys or passwords or developer-specific settings reside and which is also ignored by source control.

Joey Over a year ago

An empty keys.config is a bad idea because changes will invariable find their way into source control again :-). The actual config should not ever be checked in.

Jaex Over a year ago

I know i can't hide keys but API service owners have rule to not share keys in public so even if it is very easy to decompile and see them in C# application still i must hide them in Git. I don't think storing 30 different uploader api keys in registry is good idea.

Jaex Over a year ago

I checked config file now and when project is compiled it creates config file where executable is located so API keys will be easily visible in that config file when peoples use installer and this is not allowed by some API service owners.

Chris · Accepted Answer · 2018-02-13 13:55:50Z

4

You've got two options:

Tell Git to ignore changes to APIKeys.cs on your local machine:
```
git update-index --skip-worktree APIKeys.cs
```
This will cause local changes not to get committed. If you ever do want to commit changes to the file, you'll have to undo this with the --no-skip-worktree flag.
Rename the APIKeys.cs file to something like APIKeys.template.cs, containing the blank strings that you want to share. Keep this file in your repository. Copy that file to APIKeys.cs. Add APIKeys.cs to your .gitignore. Add instructions to copy the template file and modify with local settings.
```
git mv APIKeys.cs APIKeys.template.cs
$EDITOR APIKeys.template.cs
git commit
cat APIKeys.cs >> .gitignore
cp APIKeys.template.cs APIKeys.cs
```

edited Feb 13, 2018 at 13:55

answered Feb 14, 2014 at 12:55

Chris

139k139 gold badges316 silver badges293 bronze badges

2 Comments

Jaex Over a year ago

I tried assume-unchanged and it is working perfectly. When i do pull, Git not overwrite my api keys file with empty one and i can't push my api keys to server to overwrite empty file so it is exactly what i want. But if one developer forget to do assume-unchanged then that person can accidentally push api keys which is problem. But i don't think i can find better solution than assume-unchanged.

Chris Over a year ago

@Jaex, yes, that is a real risk with --assume-unchanged. The other method I suggested, which is echoed by Ed Guiness and Joey, is actually my preferred approach.

Chris Oldwood · Accepted Answer · 2014-02-14 13:03:06Z

Isn't this very similar to the problem of injecting a build number into your component? The way I do that is to have a pre-build step that generates a file called AssemblyVersionInfo.cs based on some environment variable. You could do the same thing with your API Keys.

In the pre-build step for the component that compiles in the API keys put something like this:-

if not defined API_KEY set API_KEY=DEFAULT_KEY
echo public class ApiKeys>"$(SolutionDir)src\ApiKeys.cs"
echo {>>"$(SolutionDir)src\ApiKeys.cs"
echo public const string Key="%API_KEY%";>>"$(SolutionDir)src\ApiKeys.cs"
echo }>>"$(SolutionDir)src\ApiKeys.cs"

Then you set either a user or system environment variable on your local machine with the real key in it.

setx API_KEY THE_REAL_KEY

To avoid Git wanting to commit the file just add it to the .gitignore.

Collectives™ on Stack Overflow

Proper way to hide API keys in Git

4 Answers 4

2 Comments

4 Comments

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

4 Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related