ACLClouds
ACLClouds

Where to store tokens and environment variables?

Separate configuration and code, limit access and regenerate an exposed secret.

A token in Git or in a screenshot should be considered compromised. The panel allows you to pass variables to the process without writing them in the code.

Step-by-step procedure

  1. Naming variables

    Use meaningful names like DISCORD_TOKEN, DATABASE_URL or API_KEY.

  2. Enter in Startup

    Add the value in the field provided by the egg. Hide secrets in screenshots.

  3. Read from code

    Use process.env in Node.js or os.environ in Python.

  4. Don't commit .env

    Add .env to the .gitignore and only provide a valueless .env.example.

  5. Respond to a leak

    Revoke the token on the original service, generate a new one and update the panel.

No secrets in a ticket

Support does not need the full token to diagnose a startup.