How to properly hide the token?

Question

Python

There is a
Config.py file, it contains:
access_token = "here is the token itself"
And there is a main.py file that reads the config via config.access_token
How can I remove the token from the repository, but put it in the secrets section, I want to open the code, but if I remove the token completely, then I won’t be able to deploy to Heroku

Answer 1

Save it to heroku environment variable and call it via:
os.environ['var_name']

Answer 2

Menu item "Settings" in Heroku admin panel:

Click "Reveal Config Vars" button, add environment variables:

Or via Heroku CLI ( https://devcenter.heroku.com/articles/config-vars ):

heroku config:set GITHUB_USERNAME=joesmith
Adding config vars and restarting myapp... done, v12
GITHUB_USERNAME: joesmith

In code, for example:

access_token = os.getenv("ACCESS_TOKEN")
...

Answer 3

We store all such information in server environment variables, this is also possible on Heroku.