How can I exclude API keys, passwords, and so on from configuration management?

Question

I am using Drupal 8 and drush cex to commit my configuration to my repository.

However, I want to keep passwords and API keys out of the repository. How do I do that? (selectively exclude sensitive information from configuration management).

For example, I'm using the SMTP module, but I noticed that in addition to the SMTP server and sender's name, etc., it also exports the API key to code, which should not be exposed. I want to manage module configuration with configuration management, but I don't want to commit the key.

Answer 1

You can't exclude specific keys easily from being exported.

However, you simply can not store the real keys there in the first place, and rely on local overrides through settings.php only, e.g.

$config['yourmodule.settings']['smtp']['api_key'] = '24ztsgfet';

And in the UI, you just store "dummy" or any other string. Note that there's currently no indication that a value is overridden in the backend, it will however display only the value that's actually stored in config, not overrides.