I am using Drupal 8 and drush cex to commit my configuration to my repository.

However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive information from configuration management).

For example, I'm using the SMTP module, but I noticed that in addition to the SMTP server and sender's name, etc., it also exports the API key to code, which should not be exposed. I want to manage module configuration with configuration management, but I don't want to commit the key.

  • I don't know about excluding config(I haven' looked into it yet) but you can store such data as state(former variables) which is unique to the site.
    – user21641
    Feb 17, 2016 at 8:29
  • I'm using Pantheon hosting and they have an interesting way of achieving this using PHP's $_ENV superglobal: pantheon.io/docs/articles/sites/code/… Feb 17, 2016 at 10:20

1 Answer 1


You can't exclude specific keys easily from being exported.

However, you simply can not store the real keys there in the first place, and rely on local overrides through settings.php only, e.g.

$config['yourmodule.settings']['smtp']['api_key'] = '24ztsgfet';

And in the UI, you just store "dummy" or any other string. Note that there's currently no indication that a value is overridden in the backend, it will however display only the value that's actually stored in config, not overrides.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.