# Using Ghost on GitHub. How do I prevent API keys from being exposed? Can I use dotenv?

**URL:** <https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928>\
**Category:** Developer help\
**Created:** [September 5, 2020, 5:15pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928 "2020-09-05T17:15:54Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![sashinexists](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/sashinexists/32/1816_2.png) [@sashinexists](https://forum.ghost.org/u/sashinexists)\
**Post date:** [September 5, 2020, 5:15pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/1 "2020-09-05T17:15:54Z")

</div>

Hello everyone,

I have been manually having to delete all my API keys from my ghost theme every time I upload it to GitHub which is honestly a pain.

Is there an easier way?

A friend told me about dotenv but that seems to be for server side apps but the JavaScript in ghost themes run on the client.

---

<div class="post-metadata">

**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\
**Post date:** [September 5, 2020, 7:21pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/2 "2020-09-05T19:21:05Z")

</div>

I think your best bet is to have a config partial which contains all the sensitive data, and you have git ignore that file. If you’re trying to use github actions, you can add a build step which creates the config file programmatically

---

<div class="post-metadata">

**Author:** ![sashinexists](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/sashinexists/32/1816_2.png) [@sashinexists](https://forum.ghost.org/u/sashinexists)\
**Post date:** [September 5, 2020, 7:51pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/3 "2020-09-05T19:51:26Z")

</div>

Thanks for the response!

I don’t fully understand it though, how would I make a config partial? Would I be able to access the variables in my JS files?

---

<div class="post-metadata">

**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\
**Post date:** [September 5, 2020, 8:34pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/4 "2020-09-05T20:34:50Z")

</div>

So you would include this before your scripts, and it would be something like this:

```auto
<script>
window.themeConfig = {
    contentAPIKey: 'key',
    // remaining keys go here
};
</script>

```

---

<div class="post-metadata">

**Author:** ![sashinexists](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/sashinexists/32/1816_2.png) [@sashinexists](https://forum.ghost.org/u/sashinexists)\
**Post date:** [September 5, 2020, 8:44pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/5 "2020-09-05T20:44:15Z")

</div>

Wait, so I would put this in a partial and then include it either on default.hbs or the specific page I would need it? And then .gitignore on the partial?

---

<div class="post-metadata">

**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\
**Post date:** [September 5, 2020, 9:11pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/6 "2020-09-05T21:11:46Z")

</div>

Yep, exactly! It’s very similar to how dotenv works, but since Ghost doesn’t support executing arbitrary code, you put that data in a config partial instead

---

<div class="post-metadata">

**Author:** ![Hannah](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/hannah/32/22_2.png) [@Hannah](https://forum.ghost.org/u/Hannah)\
**Post date:** [September 6, 2020, 11:07am UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/7 "2020-09-06T11:07:15Z")

</div>

Just to go back to the beginning here:

> I have been manually having to delete all my API keys from my ghost theme every time I upload it to GitHub which is honestly a pain.

What API keys are you referring to, and why do you have to delete them?

---

<div class="post-metadata">

**Author:** ![sashinexists](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/sashinexists/32/1816_2.png) [@sashinexists](https://forum.ghost.org/u/sashinexists)\
**Post date:** [September 6, 2020, 6:14pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/8 "2020-09-06T18:14:26Z")

</div>

Hi Hannah,  
I use three APIs in my ghost theme. The Google Books API, and two for SearchInGhost (which I create in the Ghost Admin Panel).

I have a list of books on my website that I use the books API to fetch info about including book covers, titles, authors and descriptions.

[You can see the list of books here.](https://sashinexists.com/recommended/)

On the same page you can see two search bars (one for the whole website, one just to search through the books. Each of these uses a different SearchInGhost API key.

I use GitHub to work on my theme, to let me revert back to any point and to collaborate with others and I don’t want the confidential API keys to be exposed there.

[This is my theme on GitHub.](https://github.com/sashinexists/sashinexists-ghost-theme)

Before uploading my theme to github, I used to go in and manually delete the API keys from the Javascript files and then add them back in (because I’d need them for testing and for production).

By putting them in a partial file and adding that file to the .gitignore, I’ve neatly solved this problem!

---

<div class="post-metadata">

**Author:** ![Hannah](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/hannah/32/22_2.png) [@Hannah](https://forum.ghost.org/u/Hannah)\
**Post date:** [September 6, 2020, 7:35pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/9 "2020-09-06T19:35:35Z")

</div>

These are client side API keys though that are readily exposed on your site, so I don’t understand _why_ you’re deleting them.

Doesn’t really matter that they are exposed in GitHub, unless you’re worried about someone forking the theme and not replacing the keys I guess.

---

<div class="post-metadata">

**Author:** ![sashinexists](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/sashinexists/32/1816_2.png) [@sashinexists](https://forum.ghost.org/u/sashinexists)\
**Post date:** [September 6, 2020, 10:04pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/10 "2020-09-06T22:04:41Z")

</div>

Oh! I see now (just viewed the source of my website)

Yeah, you’re right they are already exposed on the site.

There might be little benefit to what I’ve done indeed 😅

To be honest I don’t feel like I know what I’m doing and I’m just making it up as I go. When exposing a key in the past, I get emails from various services yelling at me, so I assumed it was serious.

---

<div class="post-metadata">

**Author:** ![woubuc](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/woubuc/32/9525_2.png) [@woubuc](https://forum.ghost.org/u/woubuc)\
**Post date:** [September 7, 2020, 6:33am UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/11 "2020-09-07T06:33:45Z")

</div>

Generally speaking, there are two types of API keys:

First off, you have your traditional _secret_ API keys that have write access to your account or to the API resources, so it can be used to do damage (e.g. change data, delete stuff, or worse). This is the default for most APIs. **Never ever use these in client-side code**. That’s probably why those emails were yelling at you.

An example of a secret API is the Ghost Admin API. you can use it to edit content, delete posts, and basically destroy the entire site. So don’t publish your Admin API key anywhere, ever.

Then there are _read-only_ API keys that are meant to be used in client-side code. They can only read data from the API, not write to it or change anything. For example the Ghost Content API. These are fine to use in client-side Javascript since people can’t abuse them. Often it is noted explicitly in the documentation if you can use a key in your client-side code.

I haven’t used the Google Books API, but I’ve worked with other Google APIs and most of them are very dynamic and configurable. So if you have set up a read-only API key, it should be fine to just leave that key in your repository if you don’t want to bother with it too much.

---

<div class="post-metadata">

**Author:** ![sashinexists](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/sashinexists/32/1816_2.png) [@sashinexists](https://forum.ghost.org/u/sashinexists)\
**Post date:** [September 7, 2020, 8:52am UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/12 "2020-09-07T08:52:33Z")

</div>

Thanks for the explanation!

This reassures me.

I believe that it’s a read-only as I only use it for reading and edit the book list manually on Google Books. Same with the SearchInGhost Ghost Content API keys, it just looks at content to use for searching.

---

<div class="post-metadata">

**Author:** ![BrunoCampana](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/brunocampana/32/6567_2.png) [@BrunoCampana](https://forum.ghost.org/u/BrunoCampana)\
**Post date:** [September 11, 2020, 10:48pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/13 "2020-09-11T22:48:54Z")

</div>

I would suggest migrate your repository to Gitlab rather than Github. Why? Because Gitlab offer you free PRIVATE repositories (in github you must pay for private repos), thus you can versionate whatever you want without this issue of privacy.

---

<div class="post-metadata">

**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\
**Post date:** [September 11, 2020, 11:03pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/14 "2020-09-11T23:03:39Z")

</div>

Github has offered unlimited free private repos [for a while](https://github.blog/2019-01-07-new-year-new-github/) 😉

---

<div class="post-metadata">

**Author:** ![BrunoCampana](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/brunocampana/32/6567_2.png) [@BrunoCampana](https://forum.ghost.org/u/BrunoCampana)\
**Post date:** [September 11, 2020, 11:27pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/15 "2020-09-11T23:27:48Z")

</div>

Sorry, my bad! Actually I made 2 mistakes in the advice: Im bot sure it would be a good practice to store API keys even in a private repo.

---

<div class="post-metadata">

**Author:** ![fedetibaldo](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/fedetibaldo/32/8261_2.png) [@fedetibaldo](https://forum.ghost.org/u/fedetibaldo)\
**Post date:** [September 16, 2020, 4:39pm UTC](https://forum.ghost.org/t/using-ghost-on-github-how-do-i-prevent-api-keys-from-being-exposed-can-i-use-dotenv/16928/16 "2020-09-16T16:39:40Z")

</div>

If you really really need to fiddle with the admin API key, I collected a couple of tips on how to exclude it from both git and your production build.

> **[How to Preview Ghost's Drafts in GatsbyJS (Part 3)](https://fedetibaldo.com/how-to-preview-ghosts-drafts-in-gatsbyjs-part-3/)**
>
> Put on your serious face; it's time to get ready for production.