instagram api rails hidden token in heroku

Question

I want to upload my api to heroku, what I want is that the token is hidden for possible hakers.This code is in ruby on rails app / assets / application.js This is my code

   var token = "MYTOKEN",
      userid =  MYUSERID,
      num_photos = 4;

    $(document).ready(function() {

    $.ajax({
        url: 'https://api.instagram.com/v1/users/' + userid + '/media/recent/?access_token=' + token,
        dataType: 'jsonp',
        type: 'GET',
        data: {access_token: token, count: num_photos},
        success: function(data){
            console.log(data);
            for( x in data.data ){
                $("#container").append('<li><img src="'+data.data[x].images.standard_resolution.url+'"></li>');
            }
        },
        error: function(data){
            console.log(data);
        }
    });
    });

Answer 1

Store the token in an environment variable which your rails app can then access and pass to the view. There are gems such as dotenv that can help you manage access to them locally. This article explains how to configure your variables in heroku.