Best way to store Joomla API token when using Web Services Topic is solved

[davidascher]

Is there a recommended 'best practice' for how to store a Joomla API token when using it to access a site via the Web Services API?

[davidascher]

Maybe this will clarify my question? I don't want to put my Joomla API token into code in plain text for security reasons. What is a secure way to store the token but be able to retrieve it for a call to the Webservices API?

[pe7er]

I don't want to put my Joomla API token into code in plain text for security reasons.

When you use a PHP script that needs to access your Joomla API, it needs an API token.
You can make that token available via an .env file that you load and read into the PHP.
That way, it is not available as plain text in the PHP script.
But it is still stored in the same place as the PHP script.

[davidascher]

Thank you. I'm using
$env = parse_ini_file('.env');
$token = $env["token"];

It's simple and quick - and I guess it is as secure as .env is.

[pe7er]

You're welcome!

Yeah, that way the API key is not displayed in your .php file anymore (and not displayed when you show your code to someone else).
Furthermore you can add it to .gitignore so that it won't be committed to an external git repository.