Private API key handling

[abbeyjackson]

Develop a process for how to handle private API keys for projects

[Doug-Luce]

I know there will be more to this conversation, but I thought I would get us started.

Handling API Keys

• API Keys should be stored in a configuration file separate from Github, such as a remote server, or Google Drive.
• Applications should load API credentials from environment variables. (For our Volunteer App we can use dotenv. https://www.npmjs.com/package/dotenv

Example

var db = require('db')
db.connect({
  host: process.env.DB_HOST,
  username: process.env.DB_USER,
  password: process.env.DB_PASS
})

• The API keys should be encrypted on the remote server and decrypted during configuration.
• Limit access to remote server by role.

[abbeyjackson]

@wellingtonmb88 Hey just wondering why this was assigned to me?