Gatsby Netlify and secret keys in gatsby-config.js

[witcradg]

Interfacing forms through an API like the Mautic API requires a public and secret key. Plugins that I’ve looked at like this one: https://www.gatsbyjs.org/packages/gatsby-source-mautic/
require the secret key to be in the gatsby-config.json file. This file is checked into the remote repo like gitlab to enable Netlify’s automatic deployment. What is it that I don’t understand about how this can possibly be secure? I could avoid checking it in but then I believe I would not be able to deploy to Netlify automatically through gitlab. I believe there has to be something I don’t understand but I don’t know what it is. Can someone provide some help here and direct me to material for reading and studying and/or tutorials?

[perry]

hi there, maybe one of the posts below contains information that is pertinent for you:

[Support Guide] Using environment variables on Netlify correctly

Last reviewed: August 2023 The preferred way to use environment variables in Netlify is to set them in our environment - be that in the Environment Variables settings UI (on the site’s “Build & Deploy settings” page), or via netlify.toml. You’ll want to choose the right pattern to meet your needs. Setting variables in our UI may be considered a bit more secure, since only people with access to the Netlify admin UI for your site can see them, rather than “anyone who can clone your repo!”. Thes…

[Support Guide] How do I keep my API keys/tokens safe using Netlify Functions?

Last reviewed by Netlify Support on Oct 2023 With Jamstack sites, using API keys/tokens to make API calls to other services is a frequent pattern. In some cases, you may want to hard code the keys in your html, when invoking those API calls - which on a service like Netlify means these keys are now public. Anyone can open their browser dev tools and view them, and of course this can lead to someone abusing this access. In some cases, this is fine. For instance, some types of Firebase and Faun…

Protecting API keys in environment variables

Would be great if you could nominate when creating an environment variable that it should be kept secret. Flagging the variable as a secret could then have the following effects: Filter the build log to mask the secret value if found (most secrets are hex/base64/simple-passwords so unlikely to have special encoding if accidentally emitted) Make the secret write-only in the UI, i.e. users can see that there is a value configured and it’s name but not copy/view what the current value is. Regar…

How to hide stripe secret key using lambda function

I am using a serverless lambda function to run Stripe payments. In my server function i have the following… require(‘dotenv’).config() const stripe = require(‘stripe’)(process.env.STRIPE_SECRET_KEY); i have a .env file with the SK in there, and this works when running on localhost. But it doesnt work when i deploy. I have added the SK in Netlify’s dashboard STRIPE_SECRET_KEY sk_test_opK…sIKZ But it doesnt work for me, what am i doing wrong?

If you still don’t have a starting point after working through those posts, post again here and we will try and find additional resources for you

[witcradg]

This seems perfect. I’ll do a deep dive when I get some time.
Thank you @perry

[swyx]

gatsby-config.js is run in node.js, it should be pretty easy to chuck your key in build environment variables and then check process.env.MY_SECRET_KEY. so for your case:

{
    resolve: 'gatsby-source-mautic',
    options: {
        baseUrl:  process.env.MY_MAUTIC_BASE_URL,
        auth: 'basic', [optional]
        publicKey: [your username],
        secretKey: process.env.MY_SECRET_KEY
    }
}