# Ways to store external API keys?

**URL:** <https://community.homey.app/t/ways-to-store-external-api-keys/15635>\
**Category:** Developers\
**Created:** [July 15, 2019, 9:11pm UTC](https://community.homey.app/t/ways-to-store-external-api-keys/15635 "2019-07-15T21:11:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kyrcio](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/kyrcio/32/10170_2.png) [@Kyrcio](https://community.homey.app/u/Kyrcio)\
**Post date:** [July 15, 2019, 9:11pm UTC](https://community.homey.app/t/ways-to-store-external-api-keys/15635/1 "2019-07-15T21:11:29Z")

</div>

If I were to work on an integration app where I have to apply for an API key for it, I cannot just check in the key to the GitHub project as that would most likely violate the ToS and probably invalidate the key.

Is there someplace I can store these keys securely? Since Athom publishes the apps directly from GitHub there is no intermediate step, right?

I am fully aware that storing secrets so they can be read (decrypted) on the end user device is not fool-proof, but this is not my point as keeping them out of hands of rooted Homeys (do they exist?) is (I believe) beyond what’s expected of me.

---

<div class="post-metadata">

**Author:** ![Caseda](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/caseda/32/138695_2.png) [@Caseda](https://community.homey.app/u/Caseda)\
**Post date:** [July 15, 2019, 10:15pm UTC](https://community.homey.app/t/ways-to-store-external-api-keys/15635/2 "2019-07-15T22:15:00Z")

</div>

You can add environmental variables into the app store when you add your app in the app store.

See: [Home - Homey Apps SDK v3](https://apps.developer.athom.com/tutorial-App%20Store.html)

> When submitting your app, you can enter the variables during the submission process.

There are no rooted Homey’s, bootloader is not reachable by us mere mortals

They do state it is not 100% safe (only 99.9%), but what is when talking about the internet.

---

<div class="post-metadata">

**Author:** ![Kyrcio](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/kyrcio/32/10170_2.png) [@Kyrcio](https://community.homey.app/u/Kyrcio)\
**Post date:** [July 17, 2019, 3:14pm UTC](https://community.homey.app/t/ways-to-store-external-api-keys/15635/3 "2019-07-17T15:14:26Z")

</div>

I saw that but I never figured out where to enter the actual data. I’ll give it another shot then.