Build and deploy a web app with Python, Flask, and Doppler
Tags: webdev, security, python, beginners
Published: 2021-10-04 22:57:07

Picture this: You’re building an app that uses global configuration values (public and private keys, environment execution configurations, database credentials, domain names, and URLs), and you need to update them frequently. The first solution you’ll come up with is to manage your global values using ENV files. Still, soon enough, you’ll realize that this approach can be a burden and is unscalable, especially in a distributed architectural system.

Suppose you found a solution that serves as a universal secrets manager and allows you to synchronize environment variables at scale efficiently. Would this help you solve your problem better than ENV files? The answer is YES, and the best solution for your issue is Doppler.

This tutorial will teach you how to integrate Doppler into your apps and store your secrets with it. In this article, you will build and deploy a demo app with Python (Flask) and Heroku, then manage its secrets and environment variables using Doppler.

# What is Doppler?

[Doppler](https://www.doppler.com) is a universal secrets manager that allows you to efficiently synchronize environment variables across devices, environments, and team members. It will enable you to store, share, and access secrets from a centralized source with support for collaboration, access controls, versioning, secrets documentation, and many more.

# Benefits of using Doppler

Doppler provides many unique features and functionalities that make it more than just a storage for secrets. Here are some of them:

* Doppler simplifies the synchronization of secrets and app configuration across devices, environments, and team members.
* Doppler allows your teams to collaborate and organize secrets across multiple projects and environments.
* Doppler helps developers automate the process of updating secrets in their apps across several locations.
* Doppler lets you deploy everywhere, be it Docker, serverless environments, or anywhere you work.
* Doppler boosts your team's productivity by removing the burden of keeping ENV files in sync.
* Doppler supports secrets versioning, meaning you can easily track changes in real-time and roll back broken changes.
* Doppler also lets you create documentation and notes for secrets values, so you know their usage.

# Getting started with Doppler

To continue with this tutorial, you need an account with Doppler. Create one on the [Doppler website](https://dashboard.doppler.com/register) using your email address, Google account, or Secure SSO if you don't have one.

## Step 1: Create a Doppler Project

`Projects` are used in Doppler to universally organize and manage your secrets from local development to production.

Click on the `Create Project` button in the Doppler dashboard, as shown in the image below:

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cf66283ubismsh4yauak.png)

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/51rqtpn80mvl9fhg47tg.png)

## Step 2: Store your secrets in Doppler

To store secrets in Doppler, select the `Project` you want to configure from your dashboard. Click on the `Project` you created earlier:

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t3lcxd6jchevuy0s35xi.png)

Then, choose the environment execution mode (development, staging, production) to configure your secrets. Select the `dev` config:

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/92435fvtqd2yahczyy5o.png)

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/un3utlfpzh21stelxvcn.png)

Next, configure the `Project` config and store secrets in it. Click on the `Add First Secret` button to add secrets manually or the `Import Secrets` button to fetch them from an ENV, JSON or YAML file.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qzrdh730m31qo5xqnqcx.png)

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ktlzgixib2uh6rk25ntw.png)

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cq8m9uok0aiu3eg0zow0.png)

> Don't forget to press the `Save` button after adding/updating your secrets in Doppler.

## Step 3: Install the Doppler CLI

The Doppler CLI is a lightweight binary that allows you to access your secrets in any environment (local, development, CI/CD, staging, production). Follow [this guide](https://docs.doppler.com/docs/enclave-installation#installation) to install it on your machine.

## Step 4: Authenticate the Doppler CLI

To connect the Doppler CLI to your account and access the secrets of your `Projects`, you need to be authenticated on it using an access token. Doppler CLI provides a `doppler login` command to authenticate yourself via your browser (for local development).

In the terminal, type the following:

```sh
doppler login
```

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e022cp7b1qblr28djgkw.png)

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bxvd8n8e80y4e9s4axj2.png)

> You only need to do this once per workplace. If you have multiple workplaces, you can [scope each login](https://docs.doppler.com/docs/cli#authenticating-multiple-workplaces) to a separate directory.

## Step 5: Set up a Doppler Project

After installing and authenticating the Doppler CLI, you need to configure it with a `Project` in your development environment to fetch its secrets. Doppler CLI provides a `doppler setup` command to configure your app with a `Project`.

Change the current directory to your app directory, then type the following in the terminal:

```sh
cd ./your/project/directory  
doppler setup
```

Now, select the `Project` and `config` you want to configure your app to use:

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ts8f67pcu1r1mvr3bbdc.png)

> You can also use a `doppler.yaml` file to pre-configure the Doppler `Project` and `config` for your app. Follow [this guide](https://docs.doppler.com/docs/enclave-installation#project-setup) to learn how.

> Doppler allows you to set up secrets for multiple projects on a single machine simultaneously by scoping them to specific directories.

## Step 6: Inject Doppler into running processes

After setting up the `Project` and `config` of your secrets for your app, you can inject your secrets as environment variables into running processes using `doppler run`. Let’s see an example where we access our secrets from the Python shell.

In your terminal, type the following:

```sh
doppler run -- python3

import os  
print(os.getenv("DB_URL"))  
print(os.getenv("PAYMENT_KEY"))
```

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t21ia62xf20d4z44yzxx.png)

Here, you launched a process (`python3`) and injected your secrets (that we created earlier) into it using `doppler run`. Then, you fetched the secrets from environment variables using `os.getenv()`.

> You can learn more ways to inject Doppler into running processes from [this guide](https://docs.doppler.com/docs/enclave-installation#usage).

# Setting up the Python app

Now that you have successfully injected your secrets into a running process using Doppler, let's start building a Python (Flask) web app that uses the secrets you stored in Doppler.

## Step 1: Install the Flask web framework

You need to install Flask on your machine. In the terminal, type the following:

```sh
pip install Flask
```

## Step 2: Create the Flask app

Create a file named `app.py` in the same directory you set up Doppler and save the following code in it:

```python
from flask import *

app = Flask(__name__)


@app.route("/")
def home():
    return "Hello World!"


if __name__ == "__main__":
    app.run(debug=True)
```

## Step 3: Start the app with Doppler

Start the app using `doppler run` to inject the secrets into the Flask server. In the terminal, type the following:

```sh
doppler run -- python3 app.py
```

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ipkwktrfd7ssd4lb3njx.png)

When you open the `http://127.0.0.1:5000` URL in your browser, you will get a response like this:

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3gcjnuyuyg0rsb1brosz.png)

# Integrating Doppler with Python and Flask

Let's fetch the secrets from Doppler and use them in the Python (Flask) web app. Since Doppler injects secrets as environment variables, you can easily retrieve them using the built-in `os.getenv()` function provided by Python like you would when using ENV files.

## Step 1: Update the Flask app

Update the `app.py` you created earlier with the code below:

```python
import os
from flask import *

app = Flask(__name__)


@app.route("/")
def home():
    response = f"""
    <h1>Doppler Secrets</h1>

    <h3>DB_URL: {os.getenv('DB_URL')}</h3>
    <h3>API_HOST: {os.getenv('API_HOST')}</h3>
    <h3>PAYMENT_KEY: {os.getenv('PAYMENT_KEY')}</h3>
    <h3>ADMIN_USERNAME: {os.getenv('ADMIN_USERNAME')}</h3>
    """

    return response


if __name__ == "__main__":
    app.run(debug=True)
```

## Step 2: Start the app with Doppler

Start the app using `doppler run` and open the `http://127.0.0.1:5000` URL in your browser to confirm Doppler injected your secrets correctly.

```sh
doppler run -- python3 app.py
```

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i73ert39t89ok2qz50dh.png)

## Step 3: Update the secrets in Doppler

Change the secrets from your Doppler dashboard to see how easy, efficient, and scalable the synchronization of your environment variables has become.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/knutmseph38js9sdzqb7.png)

# Deploying the Flask app

Doppler provides integrations for many cloud providers, including Heroku, AWS, Digital Ocean, Azure, Docker, GCP, [and many more](https://www.doppler.com/integrations) to keep your secrets synchronized wherever you develop and deploy.

Doppler also simplifies the whole cloud provider integration process, only requiring you to set things up with a couple of clicks. Let's see how to integrate Doppler with Heroku.

## Step 1: Create an app in Heroku

Login to your [Heroku dashboard](https://id.heroku.com/login) and create a new app to deploy your Python (Flask) app.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h37d4au88b4cqpqmvc4d.png)

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oe89hsw21ols2zjblxkb.png)

## Step 2: Integrate Doppler with Heroku

Head over to the `INTEGRATIONS` tab in the `stg` (staging) config setup of your Doppler `Project`.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xy2tf3z139phw3yx4iby.png)

> Don't forget to configure your secrets in the `stg` config of your `Project`.

Next, click on the `Add Integration` button and select Heroku from the list of cloud providers.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bm2v69gcnnchvhjp3jjb.png)

Then, authorize Doppler to have access to your Heroku account.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yhcshue4tc77g7ayicj3.png)

Finally, complete the integration process by setting the following:

* Heroku Project Type: Either a Heroku `App` or `Pipeline`.
* App: The name of the Heroku app that you created earlier (`doppler-demo`).
* Config to sync: The config that Doppler should inject into your app (`stg`).
* Import Options: Whether to import previously configured environment variables in Heroku to Doppler.

Click on the `Set Up Integration` button after providing all the necessary information.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vh4qv97zfblojgg4uq27.png)

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3a8kih7a9mtklo7s4o2q.png)

You have successfully integrated Doppler with Heroku. Whenever you make changes (adding/updating) to your `Project` secrets, Doppler will automatically synchronize them with your Heroku app's `Config Vars`.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6uzt4119q3xunxp9qigx.png)

## Step 3: Deploy your app to Heroku

Deploy your app to Heroku as you would typically do.

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h8k2mxp7n2beok16pbam.png)

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v064aj8bz0ics8moq4rf.png)

# Conclusion

By integrating Doppler with Python (Flask) and Heroku, you built and deployed a web app with efficient and scalable secrets management using minimal effort. You saw how to store, share, and access secrets using [Doppler](https://www.doppler.com) and integrate your `Project` with a cloud provider.

You can also learn more about Doppler from the [official documentation](https://docs.doppler.com/docs). If you have any questions, contact me on Twitter: [@LordGhostX](https://twitter.com/LordGhostX)