# apiKey environment variable instead of .coda.json file

**URL:** <https://connect.superhuman.com/t/apikey-environment-variable-instead-of-coda-json-file/37612>\
**Category:** Making Packs\
**Created:** [February 13, 2023, 5:43pm UTC](https://connect.superhuman.com/t/apikey-environment-variable-instead-of-coda-json-file/37612 "2023-02-13T17:43:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![orth](https://yyz1.discourse-cdn.com/coda1/user_avatar/connect.superhuman.com/orth/32/38148_2.png) [@orth](https://connect.superhuman.com/u/orth)\
**Post date:** [February 13, 2023, 5:43pm UTC](https://connect.superhuman.com/t/apikey-environment-variable-instead-of-coda-json-file/37612/1 "2023-02-13T17:43:33Z")

</div>

I’m trying to integrate my pack upload process to only be possible through GitHub Actions and a merge to master. I’m, however, concerned about the security of my apiKey secret having to populate the .coda.json file during the build process. It doesn’t appear as though an environment variable is possible instead of the file.

Could this option be considered to be added instead of the file? If not, does anyone have a suggestion for how to securely manage this process? Is it secure to place the secret in the .coda.json file, perform the upload process and then delete the file or could something be unsafe about this process?

Any insight would be great!

Thanks,  
James

---

<div class="post-metadata">

**Author:** ![Eric\_Koleda](https://yyz1.discourse-cdn.com/coda1/user_avatar/connect.superhuman.com/eric_koleda/32/50286_2.png) [@Eric\_Koleda](https://connect.superhuman.com/u/Eric_Koleda)\
**Post date:** [February 14, 2023, 2:37pm UTC](https://connect.superhuman.com/t/apikey-environment-variable-instead-of-coda-json-file/37612/2 "2023-02-14T14:37:43Z")

</div>

Hi @orth - Thanks for the feedback, that is something we’ve heard before as well. You can work around the limitation by generating your `.coda.json` in the action, as shown here:

> [@Feedback on passing Coda API key as a command line argument when running \`coda upload\` command](https://connect.superhuman.com/t/feedback-on-passing-coda-api-key-as-a-command-line-argument-when-running-coda-upload-command/32748/2):
>
> Hi @Mohammad_Mohammad2 - Thanks for kicking off this discussion. I’ve had people mention to me that they wanted to set up a GitHub action before, but I hadn’t had time to look into it to date. I agree that it would be nice to have a parameter for the token for cases like this, and I can see if the engineers would be open to accepting that PR. I did some testing and found that I could create a .coda.json file without too much trouble. Here’s what my workflow file looks like: name: Pack Actions …

In the long run though it would be nice to just make it a command line argument.

---

<div class="post-metadata">

**Author:** ![Eric\_Koleda](https://yyz1.discourse-cdn.com/coda1/user_avatar/connect.superhuman.com/eric_koleda/32/50286_2.png) [@Eric\_Koleda](https://connect.superhuman.com/u/Eric_Koleda)\
**Post date:** [February 14, 2023, 8:15pm UTC](https://connect.superhuman.com/t/apikey-environment-variable-instead-of-coda-json-file/37612/3 "2023-02-14T20:15:11Z")

</div>

Hi @orth - I just submitted a [pull request](https://github.com/coda/packs-sdk/pull/2460) that adds a new `--apiToken` argument to the `upload` command (among others) for this purpose. It isn’t released yet, but I’ll see if we can get it out soon.

---

<div class="post-metadata">

**Author:** ![orth](https://yyz1.discourse-cdn.com/coda1/user_avatar/connect.superhuman.com/orth/32/38148_2.png) [@orth](https://connect.superhuman.com/u/orth)\
**Post date:** [February 14, 2023, 8:47pm UTC](https://connect.superhuman.com/t/apikey-environment-variable-instead-of-coda-json-file/37612/4 "2023-02-14T20:47:36Z")

</div>

Ah, thanks so much Eric! That’s funny you did that as I just hacked my Actions to directly edit the coda source itself as a quick hack, hehe. I had this

```auto
      - name: Patch config_storage.js
        run: |
          sed -i.bak -e 's|function getApiKey(codaApiEndpoint) {|&\
            const codapiKey = process.env.CODA_API_KEY;\
            if (codapiKey) {\
              return codapiKey;\
            }\
          |' node_modules/@codahq/packs-sdk/dist/cli/config_storage.js

      - name: Upload pack to Coda
        run: npx coda upload pack.ts

```

---

<div class="post-metadata">

**Author:** ![Eric\_Koleda](https://yyz1.discourse-cdn.com/coda1/user_avatar/connect.superhuman.com/eric_koleda/32/50286_2.png) [@Eric\_Koleda](https://connect.superhuman.com/u/Eric_Koleda)\
**Post date:** [March 2, 2023, 8:33pm UTC](https://connect.superhuman.com/t/apikey-environment-variable-instead-of-coda-json-file/37612/5 "2023-03-02T20:33:56Z")

</div>

Hi @orth - To close the loop, we just released version 1.3.0 of the SDK which includes the new `--apiToken` argument. Thanks for the nudge!

> [@Pack SDK version 1.3.0 released](https://connect.superhuman.com/t/pack-sdk-version-1-3-0-released/38101):
>
> Hello Pack Makers - We just released a minor update to the Coda Pack SDK with the following changes: Added Added an --apiToken argument to the clone, create, link, release, and upload CLI commands. This makes it easier to use the CLI in a CI/CD environment where the API token is passed as an environment variable (GitHub Actions, etc). Changed Updated PrecannedDateRange to match the date range picker in the Coda UI: added Last90Days, Last180Days, Last365Days, Next90Days, Next180Days, Next365…