How do I commit password only to heroku and not to github?

Question

I have designed an emailer and the SMTP gateway has authentication id and password which resides in the code. Now, I want to commit them to heroku but not to github. There are multiple collaborators on the project. So, I can create a new branch and keep the keys there and deploy it to heroku. This branch stays only locally and does not make it to github. However, if I follow this method, then all collaborators have to maintain a local branch for heroku and always follow the following procedure for deployment: 1. commit changes on master 2. merge master and heroku branches 3. deploy heroku branch

This seems error-prone and repititive. Not elegant.

The other way that occurred to me is to make a commit with the authentication values, push to heroku and then revert the commit. However, I think the authentication values will still make it github, if I do this. Even if github does not have the authentication values, it has to be done every time a collaborator pushes any new feature.

Please suggest.

Answer 1

You should be able to put your sensitive information into configuration variables in heroku, and then reference those config/environment variables, instead of directly using the passwords, etc. See Configuration and Config Vars on the Heroku Dev Center.