Credentials

Jumpstart Pro uses Rails environment credentials to separate out credentials for each environment into its own encrypted file.

Environment Credentials

Rails introduced "environment credentials" which we strongly encourage using.

You can share the keys for each environment with only the users / environments that need to know them, which improves the security of your credentials. This also helps make sure you don't accidentally use development keys in production or vice versa.

rails credentials:edit --environment=development
rails credentials:edit --environment=staging
rails credentials:edit --environment=production

Protip: We recommend adding an EDITOR environment variable to your ~/.bashrc or ~/.zshrc file to automatically set this when you open a terminal. This way you won't be required to prepend the rails credentials:edit command with EDITOR="..." every time.

export EDITOR="vim" # Use Vim as default editor
export EDITOR="mvim -f" # Use MacVim as default editor
export EDITOR="code --wait" # Use VSCode as default editor
export EDITOR="atom --wait" # Use Atom as default editor
export EDITOR="mate --wait" # Use TextMate as default editor

Deploying Rails Credentials

Add your config/credentials/staging.key or config/credentials/production.key to your environment variables as RAILS_MASTER_KEY. This will let Rails decrypt your credentials based upon the RAILS_ENV that is set.

Organizing Credentials

When you create your credentials file for the first time, the contents will look like this to make adding your API keys really easy.

# Used as the base secret for all MessageVerifiers in Rails, including the one protecting cookies.
secret_key_base: <%= secret_key_base %>

active_record_encryption:
  primary_key: <%= SecureRandom.alphanumeric(32) %>
  deterministic_key: <%= SecureRandom.alphanumeric(32) %>
  key_derivation_salt: <%= SecureRandom.alphanumeric(32) %>

# aws:
#   access_key_id: 123
#   secret_access_key: 345

# Login Providers via OmniAuth
# ---------------
omniauth:
  # Add other OmniAuth providers here

  facebook:
    # https://developers.facebook.com/apps/
    public_key: ''
    private_key: ''
    # scope: 'email'

  google_oauth2:
    # https://code.google.com/apis/console/
    public_key: ''
    private_key: ''

  github:
    # https://github.com/settings/developers
    public_key: ''
    private_key: ''
    # scope: 'user:email'

  microsoft_graph:
    # https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps
    public_key: ''
    private_key: ''

  twitter:
    # https://apps.twitter.com
    public_key: ''
    private_key: ''
    secure_image_url: 'true'

# Mail Providers
# --------------

mailjet:
  # https://app.mailjet.com/account/setup
  username: ''
  password: ''
  domain: ''

mailgun:
  # https://app.mailgun.com/app/sending/domains/<YOUR_MAILGUN_DOMAIN>/credentials
  api_key: ''

mailpace:
  # https://app.mailpace.com/ -> API Tokens
  api_token: ''

postmark:
  # https://account.postmarkapp.com/servers -> Server -> API Tokens
  api_token: ''

sendgrid:
  # https://app.sendgrid.com/settings/api_keys
  username: 'apikey' # Leave this alone, the username is actually 'apikey'
  password: ''
  domain: example.com

ses:
  # https://console.aws.amazon.com/ses/home
  username: ''
  password: ''
  address: ''

### Payment Providers

# Braintree Payments (Required for PayPal support)
# https://braintreegateway.com
# https://sandbox.braintreegateway.com
# Webhooks should be pointed to https://domain.com/webhooks/braintree
braintree:
  environment: ''
  public_key: ''
  private_key: ''
  merchant_id: ''

# Stripe Payments
# https://dashboard.stripe.com/account/apikeys
stripe:
  public_key: ''
  private_key: ''

  # For processing Stripe webhooks
  # https://dashboard.stripe.com/account/webhooks
  # Webhooks should be pointed to https://domain.com/webhooks/stripe
  signing_secret: ''

# Paddle Billing
# https://vendors.paddle.com/authentication
paddle_billing:
  environment: 'sandbox'
  seller_id: ''
  api_key: ''
  client_token: ''

  # For processing webhooks
  # Webhooks should be pointed to https://domain.com/webhooks/paddle_billing
  signing_secret: ''

# Paddle Classic
# https://vendors.paddle.com/authentication
paddle_classic:
  vendor_id: ''
  vendor_auth_code: ''

  # For processing webhooks
  # https://vendors.paddle.com/public-key (only base64: MII...==)
  # Webhooks should be pointed to https://domain.com/webhooks/paddle_classic
  public_key_base64: ''

###  Integrations

airbrake:
  # https://airbrake.io
  project_id: ''
  project_key: ''

appsignal:
  # https://appsignal.com App -> App Settings -> Push & deploy -> Push key
  api_key: ''

bugsnag:
  # https://app.bugsnag.com/settings -> Projects -> API Key
  api_key: ''

convertkit:
  # https://app.convertkit.com/account/edit#account_info
  api_key: ''
  api_secret: ''

drip:
  # https://www.getdrip.com/user/edit
  api_key: ''
  account_id: ''

honeybadger:
  # https://www.honeybadger.io/
  api_key: ''

intercom:
  # https://intercom.io
  # You can find this at Settings > Installation > Web
  app_id: ''

  # Optional, used for Identity Verification
  # You can find this at Settings > Installation > Security > Enforce identity on web
  api_secret: ''

mailchimp:
  # https://mailchimp.com/
  api_key: ''

scout:
  # https://scoutapm.com/
  api_key: ''

sentry:
  # https://sentry.io
  dsn: ''

skylight:
  # https://skylight.io
  # This should be the long 40+ character token from Settings, _not_the short setup token
  # You can click "create the application manually" when setting up a new Skylight app to skip the setup token step and get your auth_token
  auth_token: ''

rollbar:
  # https://rollbar.com/
  access_token: ''