Rails encrypted credentials on 6.2
Tags: ruby, rails, webdev, tutorial
Published: 2021-09-13 07:18:16

---
title: Rails encrypted credentials on 6.2
published: true
description: Learn about encrypted version introduced with 5.1 to handling multi-environment credentials before rails 6 to Handling multi-environment credentials in rails 6 here
tags: ruby, rails, webdev, tutorial
canonical_url: https://blog.engineyard.com/rails-encrypted-credentials-on-6.2?utm_source=dev.to&utm_medium=Page-Devgraph&utm_id=QiWorks
//cover_image: https://blog.engineyard.com/hubfs/blogpic.jpg
---
By Ritu Chaturvedi

Any rails program would have secrets to be stored, for at least the secret key base with tokens for third-party APIs. Post version updates, handling secrets has become easier.

Initially, there were two methods to handle secrets.

- The first method stored secrets in the environment variable (secret\_key\_base) and committed the secrets.yml file to the repository. This had many safety constraints in place.
- The alternate method saved secrets in the secrets.yml file and avoided committing it to the repository.

In the 5.1 version, encrypted secrets were introduced, and were handled by the secrets.yml.enc file along with the encryption key control. The encryption key enabled us to commit the secrets to the repository safely.

With rails 5.2, the plain text credentials became obsolete. Since then, only encrypted credentials were in place and the same were stored and accessed by two files: _credential.yml.enc_ and _master.key ._

Credentials were stored in _config/credentials.yml.enc_ and the key was stored on _config/master.key_. This feature enabled deploying code and credentials together and also storing all credentials in one place.

## **Handling multi-environment credentials before rails 6**

Before rails 6, credentials and configurations corresponding to all environments were saved in a one-way file, with the environment as a major key and multi-environment credentials were handled by specifying explicitly.

 Development:

 aws:

 access\_key\_id: 123

 secret\_access\_key: 345

and the configuration was accessed by mentioning the access\_key\_id.

## Handling multi-environment credentials in rails 6

The Rails 6 version has taken further steps to improve the scalability of the [rails framework by including multi-environment credentials.](https://www.bigbinary.com/blog/rails-6-adds-support-for-multi-environment-credentials?utm_source=Engineyard.com) Instead of keeping one credential file to handle the secrets for all environments, separate credential files for each environment and point of deliveries are created. Though this necessitates separate encryption keys per environment, this feature brings more safety and clarity. The in-built feature of multi-environment credentials also facilitates one-way-time uploading of the encryption/decryption key to the server.

With this update, a global credential file is enough for multiple environments. And when the environment is passed, two files were created -

_config/credentials/#{environment}.yml.enc and _

_config/credentials/#{env}.key. _

Let us consider an example. The below command

_rails credentials:edit --environment prod _

would create the credential files for the production environment as

_config/credential/prod.yml.enc_ and

_config/credentials/prod.key _

and if the environment file is missing or not created, the default file _credentials.yml.enc_ file will be used.

Also, the _config/credential/prod.yml.enc file_ would be committed to the repository, and the _config/credential/prod.key_ file would not be committed.

## **Credentials in rails**

Rails understands the credential files to be used in a specific environment. If the environment-specific credentials are defined, this will be considered over the global credentials.

As for the above example,

_rails.application.credentials.config {:aws=\>{:access\_key\_id=\>"123", :secret\_access\_key=\>"345"} }} rails.application.credentials.aws[:access\_key\_id]=\> "123"_

## **Added features in rails 6**

Rails 6 also added a feature to explicitly specify the location where the credential file is stored. Committing to a known path in the repository would make handling these files easier. To save the files in a specific path of your choice, _config.credentials.content\_path and config.credentials.key\_path_ are used. While using this, one must make sure to upload the valid key as well as credentials to avoid errors/interruptions. If the respective key is not available on the path, the encrypted credentials would remain as a bunch of meaningless characters.

To handle local environment credentials, _config/credentials/environment.key_ and simple _config/master.key_ are to be used. The scenario varies in the production environment. For such a scenario, the rails\_master\_key can be used and the encryption keys from the .key file are stored here.

The below command tells rails to search the credentials file in path _config/credentials/local.yml.enc_ instead of _config/credentials/development.yml.enc_

 _config.credentials.content\_path = ‘config/credentials/local.yml.enc’ _

## Conclusion

The Rails family puts constant effort into improving the efficiency and scalability of the framework. With the multi-environment credentials enabled, applications used in multiple platforms and pods find it easier to keep the codes simple and accessible.

You can use [Engine Yard](https://support.cloud.engineyard.com/hc/en-us/articles/360058885853-Introduction-to-Engine-Yard-Kontainers?utm_source=devgraph&utm_medium=internal-link&utm_campaign=Rails-encrypted-credentials-on-6.2&utm_id=Qiworks&_ga=2.136879410.367885970.1629918955-549482685.1629918955) to connect to your database enabling the Rails credentials for improved security. Click [here](https://support.cloud.engineyard.com/hc/en-us/articles/1260801333150-Using-a-Database-with-your-Kontainers-Application)to learn how to proceed.