{"id": "plugins:plugins-configuration-secret", "page": "plugins", "ref": "plugins-configuration-secret", "title": "Secret configuration values", "content": "Any values embedded in  metadata.json  will be visible to anyone who views the  /-/metadata  page of your Datasette instance. Some plugins may need configuration that should stay secret - API keys for example. There are two ways in which you can store secret configuration values. \n                 As environment variables . If your secret lives in an environment variable that is available to the Datasette process, you can indicate that the configuration value should be read from that environment variable like so: \n                 {\n    \"plugins\": {\n        \"datasette-auth-github\": {\n            \"client_secret\": {\n                \"$env\": \"GITHUB_CLIENT_SECRET\"\n            }\n        }\n    }\n} \n                 As values in separate files . Your secrets can also live in files on disk. To specify a secret should be read from a file, provide the full file path like this: \n                 {\n    \"plugins\": {\n        \"datasette-auth-github\": {\n            \"client_secret\": {\n                \"$file\": \"/secrets/client-secret\"\n            }\n        }\n    }\n} \n                 If you are publishing your data using the  datasette publish  family of commands, you can use the  --plugin-secret  option to set these secrets at publish time. For example, using Heroku you might run the following command: \n                 $ datasette publish heroku my_database.db \\\n    --name my-heroku-app-demo \\\n    --install=datasette-auth-github \\\n    --plugin-secret datasette-auth-github client_id your_client_id \\\n    --plugin-secret datasette-auth-github client_secret your_client_secret \n                 This will set the necessary environment variables and add the following to the deployed  metadata.json : \n                 {\n    \"plugins\": {\n        \"datasette-auth-github\": {\n            \"client_id\": {\n                \"$env\": \"DATASETTE_AUTH_GITHUB_CLIENT_ID\"\n            },\n            \"client_secret\": {\n                \"$env\": \"DATASETTE_AUTH_GITHUB_CLIENT_SECRET\"\n            }\n        }\n    }\n}", "breadcrumbs": "[\"Plugins\", \"Plugin configuration\"]", "references": "[]"}