Hiding Sensitive Information in Python | Drew Seewald | Towards Data Science

In a previous post, I left a Discord token in the script. This is not the ideal way to code, especially if I don’t want to regenerate my tokens every time I share code. Using credentials and API tokens in your data science and programming projects is inevitable, but leaving them exposed is avoidable. Using the dotenv python module can help keep these sensitive bits of information safe from prying eyes.
In a previous post I went through the steps to create a Discord bot using Discord.py in python. That example will be continued here, but the same idea can be used in any code that uses sensitive credentials or API tokens
medium.com
You have completed your brand new Discord bot and want to share your code with the world. Naturally, you upload it to GitHub and send out the link. Soon the bot stops working. Why? You left your API token in the code and someone took over your bot.
You left your API token in the code and someone took over your bot
API tokens give enormous amounts of power to control applications. With certain API’s, usage is monitored and you will even be billed for your usage! Fortunately Discord doesn’t charge you, but you still need to keep your credentials safe when using them in your coding projects.
Enter environment variables. Jim Medlock has a great explanation of what they are in his An Introduction to Environment Variables and How to Use Them. In that post he says:
An environment variable is a variable whose value is set outside the program, typically through functionality built into the operating system or microservice. An environment variable is made up of a name/value pair, and any number may be created and available for reference at a point in time.
We will use them to keep our Discord token safely out of our GitHub commits. This same process can be used for any other sensitive information you add to your bot, or even in other projects you are working on. For example, if you put your username and password in the bot’s code for web scraping, you will want to use dotenv to keep it safe.
Let’s start with installing the module. We can do this using package installer for python, more commonly known as pip.
$ pip install python-dotenv
Now let’s setup our .env file. This file should always live in the project folder’s top level folder or root directory. Create a new text file in that location, renaming it to .env. Windows will ask you to confirm that you want to change the file type. Click yes.
Next, open the .env file with a text editor. I prefer Atom or Notepad++, but Notepad will work just fine. By convention, environment variables are all uppercase with words separated by underscores. We can name ours TUTORIAL_BOT_TOKEN and paste our token in. Save and close the file.
TUTORIAL_BOT_TOKEN=NzUzNzU3Mjg0NTI1NTM5MzQ4.X1q1LA.4xD7lSQrN0EqJivrrogLUScNdfY
Now my assumption is you are using GitHub as version control for your data science projects. If you aren’t, you should be! It is a great way to roll back changes to your code if something goes wrong. GitHub also enables collaboration with others. You wouldn’t want them to also have your token, so we have some work to do. If you don’t have a repository setup for the project or don’t know how to, don’t sweat it, I’ll cover this in another post. You can safely move on to the next section.
GitHub will save all of the changes to the code, but we need to exclude the .env file as that is what contains our token. To make sure that the .env file is not committed to the repository, open up the .gitignore file in your project folder and add the following line.
*.env
Adding this line will ignore the .env file that we created earlier. By using the asterisk (*), we are excluding all files in the top level folder or root directory that have the .env extension from being committed to the repository.
Now that we have the .env file with our sensitive information and it won’t get committed to your repository, we need to actually use it in our python script.
First we need to load the dotenv and os modules. For this example, we can add them to the script from my Hello World Discord.py Tutorial.
# Importsfrom dotenv import load_dotenvimport os
load_dotenv will be used to load the .env file to the environment variables. os will be used to refer to those variables in the code. Let’s start with load_dotenv. This will load the .env file.
# Credentialsload_dotenv('.env')
To use the environment variable, we can use os.getenv in the client.run command at the end of the bot script.
client.run(os.getenv('TUTORIAL_BOT_TOKEN'))
Now that everything is setup, navigate to the bot script location in the command line, running the script to start the bot.
$ cd path\to\bot$ python 02_Discord_dotenv.py
You will see the bot name and ID printed to the console. Just to be thorough, hop into the server with the bot and test the !helloworld command, it should work perfectly!
The dotenv module is a great way to obscure sensitive information. It doesn’t have to be limited to use with Discord bots. Anywhere code is using login credentials, database connection information, API tokens, or anything else you don’t want to share with the world, put it in your .env file.
For more on the dotenv python module, check out the GitHub Repository which includes more documentation on the module.
Check out another of my posts to help generate some ideas where you can apply the concepts discussed here. Make your projects stand out on GitHub while keeping your credentials safe!