Best practice for handling access keys (secrets) in URLs

@Gordon_G wrote:

I need to configure rest_commands to call IFTTT webhooks to control a lot of my devices. The urls are of the form
maker. ifttt. com/trigger/WEBHOOKTRIGGERNAME/with/key/my-ifttt-api-key

Now, a) I don’t really want my key in my main config file in case I ever want to share it here etc, and b) I certainly don’t want to be repeating it in dozens of places - I’m hoping I can change the key shortly to deprecate access from other cloud services, and it would be better to change it in one place than use find and replace. I understand from here

that secrets cannot be used in templates for “security reasons” (and I must say I don’t understand what they might be). The workaround here

is to put the whole URL as a secret - but that just shifts the problem and makes it worse - now I have dozens of URLs in my secrets file referenced from the configuration, but the key is still repeated dozens of times.

I’ve bashed my head off this for the whole weekend and resigned myself for now to just repeating the key in the URL to get some stuff working, but I must surely be missing a trick here.

What’s the best practice here?

Thanks

Posts: 2

Participants: 2

Read full topic