Issue with .gitignore file and trying to run an app on heroku

Question

I have a JS app - a newsletter signup form using mailchimp. It requires mailchimp api key and audience key which I had included in the app. I uploaded to github and that updates heroku and the app worked fine on heroku, briefly. Then mailchimp emailed me to say they had detected I had made api key public so disabled it. Git repository is public - guess I could make private as an option.

I figured I could put the keys into a config.json file and have the script get the info from there. Thats what I tried and put that filename into.gitignore so this would not go to github. However since heroku updates from github, it cant find the config.json file. If I dont put that file into.gitignore then the config.json file will be on github and again my api key will be public.

What should I be doing to keep api keys confidential while still being able to use github to update heroku?

Answer 1

What you are looking for are config variables After you added them you can load them just like any other environment variables.