Anyway to input your API key without exposing it to anyone who looks at the source code?

[pixelkat5]

Hey, I use replit, I'm following this guide and ofc the main page.
Anyways if I were to put the yaml in my source code, wouldn't it just expose my API key for anyone to use...? Which is ofc a bad thing. I might be doing some of this wrong but I should be able to use replit and the git tab to push to both the repo page and my site. Which as of now uses GitHub pages but I would assume I wouldn't need that as neocities would host it.
Sorry if this is a stupid post but I was just wondering.

[pixelkat5]

oh https://github.com/pixelkat5/Pixel5.info/settings/secrets/actions then Repository secrets right?

[bcomnes]

I can't see that but that sounds right.

[bcomnes]

Yeah definitely don't commit your token to your source code. Use github actions secrets to store the token and pass it in like the example shows:

api_key: ${{ secrets.NEOCITIES_API_TOKEN }}

If you wanted a local-first workflow, https://github.com/bcomnes/async-neocities ships a cli that can deploy from CI or locally. Locally it stores the token in a deploy-to-neocities.json (add to .gitignore! Don't commit to git!), but you can also pass in in with env vars ASYNC_NEOCITIES_API_KEY and ASYNC_NEOCITIES_SITE_NAME.

[bcomnes]

If you DID commit your token to your source code, you need to rotate your API token. Its committed to history and very hard to delete.