如何安全地将 API 凭据传递到托管我的 python 脚本的远程 Heroku 服务器？

Question

I'm currently trying to host my first discord bot on heroku. In order to get the bot up and running I have to pass several tokens for discord authentication such as authentication for some APIs I'm using.

During development I was using a config.json file which contains all the information I need for the bot to work. This works fine when hosted on my local machine, however I'm not sure if I should upload a file which contains passwords to a remote server like Heroku.

What would be a proper and secure way for me to pass my API credentials to Heroku?

Answer 1

the way to provide credentials/tokens/pwd is to use Config Vars. Only the application admin has access to this info (in the Heroku Dashboard).

It is acceptable to trust the hosting infrastructure with this data as your applications are running on it and require it. For top security applications you would probably use a different hosting solution (private cloud) or run your own server.