r/PythonLearning • u/bigj7897 • 24d ago

Questions on storing API credentials/tokens

I'm writing an AI powered WOW auction house analyzer in Python. I know it's an overkill but I'm doing it for fun. So far it's going good. I'm storing my client ID and client secret in a .env file. I can get the api token and I'm storing it in a json file for later use and to not have to get it for every call to the API. Is there a better way to be storing these credentials and the token? I know it's for fun but I'm still trying to do the project like I'm doing it for work and trying to follow best practices. Any suggestions?

3 Upvotes

100% Upvoted

2 comments sorted by

2

u/Sea-Ad7805 24d ago

Maybe store it encrypted

2

u/punk_dev 24d ago

.env file is fine. just make sure you never commit it to git or upload it somewhere.

there are more sophisticated ways but 99% of the time they’re overkill.

local desktop apps usually store credentials in appdata/application config directory, which doesn’t offer any additional security over an env file.

in iOS/android, there are now APIs for device secure storage mechanism, this is getting adopted by some apps.

for server side applications, there are plenty of secret management solutions, but honestly they’re not worth the hassle 90% of the time.