An engineer is developing a script that must call an API using a static Bearer token. Which solution securely protects the credentials from being retrievable from the source code?

Question

Accepted Answer

A. ```python
import os
import requests

def call_api():
 result = requests.get(
 "https://example.api.com",
 headers={"Authorization": "Bearer " + os.getenv("TOKEN")},
 )
 result.raise_for_status()
 return result.json()
``` This solution retrieves the `TOKEN` from an environment variable using `os.getenv("TOKEN")`. Storing sensitive information like API tokens in environment variables is a standard and secure practice because it keeps credentials out of the source code, prevents them from being committed to version control, and allows them to be managed externally (e.g., via CI/CD secrets, deployment configurations) without modifying the application code itself.

Answer

B. ```python
import requests
import base64

def call_api():
 result = requests.get(
 "https://example.api.com",
 headers={"Authorization": "Bearer "
 + base64.b64decode(b"TXlZZWN
 yZXR0ZXN0dG9rZW4==").decode("utf-8")
 },
 )
 result.raise_for_status()
 return result.json()
``` While `base64.b64decode` obfuscates the token, Base64 encoding is not encryption and can be easily decoded, meaning the token is still directly present in the source code in a recoverable form and is therefore not securely protected.

Answer

C. ```python
import requests

def call_api():
 result = requests.get(
 "https://example.api.com",
 headers={"Authorization": "Bearer
 MySecretToken"},
 )
 result.raise_for_status()
 return result.json()
``` Hardcoding the token (`MySecretToken`) directly into the source code is highly insecure, as it exposes the credential to anyone with access to the codebase and makes rotation difficult.

Answer

D. ```python
import requests
from .password import token

def call_api():
 result = requests.get(
 "https://example.api.com",
 headers={"Authorization": "Bearer " + token},
 )
 result.raise_for_status()
 return result.json()
``` Importing the token from a local file like `.password.py` might separate it from the main script, but if `.password.py` itself contains the token directly and is part of the same repository, it offers no real security benefit and could still be committed to version control.

An engineer is developing a script that must call an API using a static Bearer token. Which solution securely protects the credentials from being retrievable from the source code?

Question

Options

How the community answered

Why each option

Topics

Community Discussion