3 Ways to Store and Read Credentials Locally in Python
Tags: python, security, programming, codenewbie
Published: 2021-06-21 04:40:32




Originally posted on [realpythonproject.com](https://www.realpythonproject.com/3-ways-to-store-and-read-credentials-locally-in-python/)

<p><em>Connect with me on </em><a href="https://www.linkedin.com/in/rahulbanerjee2699/" rel="noreferrer noopener" target="_blank"><em>LinkedIn</em></a><em>, </em><a href="https://twitter.com/rahulbanerjee99" rel="noreferrer noopener" target="_blank"><em>Twitter</em></a></p>



We will be discussing 3 different ways to store credentials and read them using Python. 
- Storing them as system variables
- Storing them as variables in your virtual environment 
- Storing them in a .env file 
- The Most Convenient Way


### Storing them as Global Environment Variables
If the credentials are stored as Global Environment Variables, they can be accessed by any script running in any environment on your PC.

To Create a Global Environment Variable, run this in your terminal
```zsh
export varName=varValue
```
Ensure there are no spaces between the '='. If you get an error "zsh: Bad Assignment", it is probably caused because of space between the '='. 

Let's create a couple of global environment variables

```zsh
export globalSecretUser=global_rahul1999
export globalSecretKey = global_xy76hUihk
```

In Windows, you might have to use "set" instead of "export"

The above script needs to be run in the terminal. Now, let us try accessing the variables we created earlier.

```python
import os
print(os.environ) 
# This will print a dictionary with 
# all the global environment variables
```
We can use dictionary access methods to read the environment variables, i.e using .get() or [ ] 

```python
print(os.environ.get('globalSecretUser'))
print(os.environ.get('globalSecretKey'))

'''
global_rahul1999
global_xy76hUihk
'''
```
To update the environment variables, simply run the export statement again

```zsh
export globalSecretUser=Updated_rahul1999
```

Let's try accessing the variable in Python again 
```python
import os 

print(os.environ.get('globalSecretUser'))

'''
Updated_rahul1999
'''
```
To remove an environment variable, we use the unset keyword

```zsh
unset globalSecretUser
```
If you try to access the variable in Python, you will either get a KeyError or None depending on the method you use to access the values in the dictionary.


### Storing them as variables in your virtual environment 
 These environment variables will only be accessible to scripts running in the virtual environment where the variables are created. We can think of them as "local" environment variables.

First, we will have to create a virtual environment 

On Mac

```zsh
python3 -m venv venv
```

On Windows
```bash
python -m venv venv
```

This will create a virtual environment in your current directory. There should be a file named "activate inside the bin folder. if you are on Windows, it should be inside the Scripts folder. This script runs every time we activate our virtual environment.

We will be adding our variables to this script. Therefore, every time we activate our virtual environment, the environment variables will be created. Open the file.

Before we create our variables, we will need to add some code to make sure the variables do not exist once the virtual environment has been deactivated.

We will use the unset keyword, go to the function deactivate() inside the activate script and unset the variables at the beginning of the function

```bash
deactivate () {
    unset localSecretUser
    unset localSecretKey
    # Some Code
}
```
Now, we will use the export keyword to define the variables. This code should go outside the deactivate function at the end of the activate script

```bash
deactivate(){
     # Some Code
}
# Some More Code
export localSecretUser=local_secret_rahul199
export localSecretKey=local_secret_xyudJIk12AA
```
In Windows, you might have to use "set" instead of "export"

Now we will need to activate our virtual environment. If you have already activated your virtual environment you can use the deactivate keyword to deactivate your virtual environment
```bash
deactivate
```
Type the above in the terminal.

Now let's activate our virtual environment. 
On Mac
```bash
source venv/bin/activate
```
On Windows
```bash
venv/Scripts/activate
```
You can list down the current environment's variables using the following command in the terminal 
```zsh
printenv
```
Now let's try accessing the variables we just created. It is similar to how we accessed the global environment variables

```python
import os 

print(os.environ.get('localSecretUser'))
print(os.environ.get('localSecretKey'))

'''
local_secret_rahul199
local_secret_xyudJIk12AA
'''
```

Now let's deactivate the virtual environment and try running the python script again
```zsh
deactivate
python3 main.py
```
It should return None.

### Storing them in a .env file
Inside your root folder, the folder with your virtual environment, create a file named ".env." Add the variables inside the file

```bash
#inside file named .env
secretUser = "secret_user_rahul1999"
secretKey = "secret_key_adfdsaUj12"
```

We will need to install a python library to read the variables

```bash
pip3 install python-dotenv
```
Let's read the variables in Python

```python
from dotenv import load_dotenv
import os 

load_dotenv()
print(os.environ.get('secretUser'))
print(os.environ.get('secretKey'))

'''
secret_user_rahul1999
secret_key_adfdsaUj12
'''
```

Do not forget to add the .env file inside your .gitignore file. This will ensure that your credentials are not pushed to your git repository. 

```
# Inside .gitignore

.env
```

### The Most Convenient Way

In my opinion, the most convenient way is to store them inside a  .env file. 
- They are local to your project
- You do not need to worry about 'unsetting' them 
- If you add them to your .gitignore file, it is safe from the outside world 
- If you deploy your script as a serverless function, you will need to use "load_dotenve()" to read the environment variables stored inside the configuration file of your Azure/AWS environment. 

Although it has many pros, one con would be when we have a variable inside the .env file with the same name as a global environment variable. Accessing the variable in Python will return the global value since we are not using "unset" to unset the variable value or "export" to assign a new value to the variable.

Let me know if you prefer any of the other methods or if think one of them is safer than the other.