Load JSON file's content to Heroku's environment variable

Question

I am using Google Speech API in my Django web-app. I have set up a service account for it and am able to make API calls locally. I have pointed the local GOOGLE_APPLICATION_CREDENTIALS environment variable to the service account's json file which contains all the credentials.

This is the snapshot of my Service Account's json file:

I have tried setting heroku's GOOGLE_APPLICATION_CREDENTIALS environment variable by running

$ heroku config:set GOOGLE_APPLICATION_CREDENTIALS="$(< myProjCreds.json)"

$ heroku config
GOOGLE_APPLICATION_CREDENTIALS: {

^^ It gets terminated at the first occurrence of " in the json file which is immediately after { and

$ heroku config:set GOOGLE_APPLICATION_CREDENTIALS='$(< myProjCreds.json)'

$ heroku config
GOOGLE_APPLICATION_CREDENTIALS: $(< myProjCreds.json)

^^ The command gets saved into the environment variable

I tried setting heroku's GOOGLE_APPLICATION_CREDENTIALS env variable to the content of service account's json file but it didn't work (because apparently the this variable's value needs to be an absolute path to the json file) . I found a method which authorizes a developer account without loading json accout rather using GOOGLE_ACCOUNT_TYPE, GOOGLE_CLIENT_EMAIL and GOOGLE_PRIVATE_KEY. Here is the GitHub discussion page for it.

I want something similar (or something different) for my Django web-app and I want to avoid uploading the json file to my Django web-app's directory (if possible) for security reasons.

Answer 1

Depending on which library you are using for communicating with Speach API you may use several approaches:

1. You may serialize your JSON data using base64 or something similar and set resulting string as one environment variable. Than during you app boot you may decode this data and configure your client library appropriately.

2. You may set each pair from credentials file as separate env variables and use them accordingly. Maybe library that you're using support authentication using GOOGLE_ACCOUNT_TYPE, GOOGLE_CLIENT_EMAIL and GOOGLE_PRIVATE_KEY similar to the ruby client that you're linking to.

EDIT: Assuming that you are using google official client library, you have several options for authenticating your requests, including that you are using (service account): https://googlecloudplatform.github.io/google-cloud-python/latest/core/auth.html You may save your credentials to the temp file and pass it's path to the Client object https://google-auth.readthedocs.io/en/latest/user-guide.html#service-account-private-key-files (but it seems to me that this is very hacky workaround). There is a couple of other auth options that you may use.

EDIT2: I've found one more link with the more robust approach http://codrspace.com/gargath/using-google-auth-apis-on-heroku/. There is ruby code, but you may do something similar in Python for sure.