Securing API Keys in a Strapi Plugin

A publishing plugin needs tokens for Medium, Dev.to, and Bluesky. Here's how to keep them safe.

Never hard-code secrets

Keep them out of your source code and out of git.

Option 1: Environment variables

DEVTO_API_KEY=xxxx
MEDIUM_TOKEN=xxxx

// config/plugins.ts
export default ({ env }) => ({
  'content-publisher': {
    config: { devtoApiKey: env('DEVTO_API_KEY') },
  },
});

Option 2: A settings page

If admins should manage keys from the UI, store them with the plugin store and protect the route with admin permissions. Never return the raw key to the browser — send back a masked value like ••••1234.

Checklist

• [ ] .env is in .gitignore
• [ ] Settings routes require an admin permission
• [ ] Keys are masked in API responses
• [ ] Tokens are rotated if leaked