I've built a web application which uses spotify api and it uses client id and client secret which is present in main.py i.e on the backend side of my application to fetch data regarding songs. Now I want to deploy the app on heroku and want to know whether it will be safe to deploy it like this or should I move client id and secret somewhere else.
Don't include the client id and the cilent secret into the code. Just add there a comment and the user can just add his own secrets.
How to safely store client secret?