Hello folks! How do I handle API keys in Ktor? Where do I put and access them safely?

# ktor

[manlan]

Hello folks! How do I handle API keys in Ktor? Where do I put and access them safely?

[manlan]

Anyone, please?

[Satyam Agarwal]

This is not ktor specific I think. It’s a web framework. Easiest way would be make those keys available as environment variables and use these environment variables in the config.

[manlan]

Thanks, should it look something like this?
How do I read this from Ktor code?

Untitled

[manlan]

Is putting it in the application object correct?

[Satyam Agarwal]

So I usually keep all my application specific configs outside of ktor object like this :

ktor {
  deployment {
    port = 8080
    autoreload = false
    watch = []
  }
}

db {
  connectionTestQuery = SELECT 1
  isReadOnly = false
  jdbcUrl = ${JDBC_URL}  
  password = ${SECRET_DB_USER_PASSWORD}
}

I als use https://github.com/config4k/config4k for resolving config files.

I find this approach pretty neat

[Satyam Agarwal]

and then you can override them based on environments, for example local :

ktor {
  deployment {
    environment = "local"
    autoreload = true
    watch = ["my/source/package"]
  }
}

db {
  password = ""
}

[manlan]

Thanks, seems a neat approach. Will try it 🙂