I think that the `app_key` and the `app_secret` must not be visible (not added to git).

Maybe you can use some env variables to get the keys, this env variables can be defined in a file ignored by git.