what's the best way to protect secret keys when deploying a Meteor App?
configuration, deployment, meteor
Solution
The `devel` branch (soon to be in 0.5.3) has a new `Meteor.settings` feature: if you pass a JSON file as an argument to `meteor run` or `meteor deploy`, the object will be available on the server as `Meteor.settings`. (With `meteor deploy`, this is persistent so that you don't have to remember to pass it each time.)
(If you're using your own hosting environment, you can pass the contents of the JSON file in via the `METEOR_SETTINGS` environment variable.)
Using the database works too --- that's how Meteor Accounts stores configuration for OAuth accounts. My personal opinion is that `Meteor.settings` is best for app configuration, whereas the database is best for package configuration, since that allows packages to show an interactive configuration widget on first run like `accounts-ui` does.
Problem
I'm hooking up Filepicker.io to my meteor app for file uploads. That service has an API key which (of course) they recommend keeping secret. I've found a couple other sample apps on github where the filepicker secret is in plain site in the client code. That just seems a little shaky. And even if it's not in a public repo, since it's specified in client code, I can grab the key from the app using the Javascript console (if I wanted it). I wonder there is a way to stash secrets along with an application (like heroku config) that would make it easy to keep that key secret. My current plan is to put the key in the database and lock up that model so it's only available from server code. Is there a simpler way? Thanks for any pointers.