title: Where should I store development credentials on a Spring Boot project?
body: <p>Where should I store development credentials on a Spring Boot project so that they are not committed to the repository? What's the most standard way?</p>
  
  <p>In other frameworks (Rails, Clojure) I'm used to have a file that I do not commit to the repo where that information goes. Something like a secondary application.properties that gets merged and it's never committed. Does such a thing exist?</p>
  
  <p>I'm deploying to Heroku, which provides credentials in environment variables that Spring can pick up, so, that part is solved. If I deploy somewhere else, it'll be a similar config.</p>
  
  <p>In the <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-external-config.html" rel="noreferrer">Spring Boot Docs, chapter 24, Externalized Configuration</a>, there's a list of all the places where properties are defined. I went through that list trying to find the appropriate place for credentials and I couldn't find it:</p>
  
  <blockquote>
    <p>Devtools global settings properties on your home directory
        (~/.spring-boot-devtools.properties when devtools is active).</p>
  </blockquote>
  
  <p>It's not a devtools thing, as you could want to develop locally disabling devloots.</p>
  
  <blockquote>
    <p>@TestPropertySource annotations on your tests.</p>
  </blockquote>
  
  <p>It's not about testing</p>
  
  <blockquote>
    <p>@SpringBootTest#properties annotation attribute on your tests.</p>
  </blockquote>
  
  <p>Again, not testing.</p>
  
  <blockquote>
    <p>Command line arguments.</p>
  </blockquote>
  
  <p>I'd rather not have credentials in command lines as those tend to be public in the computer, so, another program could pick them up. But besides that, I'm not running a command when development; I'm triggering the app from IntelliJ.</p>
  
  <blockquote>
    <p>Properties from SPRING_APPLICATION_JSON (inline JSON embedded in an environment variable or system property)</p>
  </blockquote>
  
  <p>Same as environment variable/system properties bellow.</p>
  
  <blockquote>
    <p>ServletConfig init parameters. 
    ServletContext init parameters. 
    JNDI attributes from java:comp/env.</p>
  </blockquote>
  
  <p>Those seem not to apply at all when developing local generating a jar,</p>
  
  <blockquote>
    <p>Java System properties (System.getProperties()).</p>
  </blockquote>
  
  <p>I'm not sure what would be the appropriate way of setting them up, but it feels laborious.</p>
  
  <blockquote>
    <p>OS environment variables.</p>
  </blockquote>
  
  <p>I either set them on my OS, which is opaque to new developers, or I set them inside the IntelliJ run profile, which makes them part of the repository, which is what I'm trying to avoid.</p>
  
  <blockquote>
    <p>A RandomValuePropertySource that only has properties in random.*.</p>
  </blockquote>
  
  <p>They are not random.</p>
  
  <blockquote>
    <p>Profile-specific application properties outside of your packaged jar (application-{profile}.properties and YAML variants)</p>
  </blockquote>
  
  <p>This could be, but I'm not sure where that file should reside.</p>
  
  <blockquote>
    <p>Profile-specific application properties packaged inside your jar (application-{profile}.properties and YAML variants) </p>
  </blockquote>
  
  <p>I want to be able to commit profile specific application properties to the repo, so, I cannot store credentials in these files.</p>
  
  <blockquote>
    <p>Application properties outside of your packaged jar (application.properties and YAML variants).</p>
  </blockquote>
  
  <p>This could be, but I'm not sure where that file should reside.</p>
  
  <blockquote>
    <p>Application properties packaged inside your jar (application.properties and YAML variants). </p>
  </blockquote>
  
  <p>I want to commit that file, so, I cannot store credentials there.</p>
  
  <blockquote>
    <p>@PropertySource annotations on your @Configuration classes. Default properties
        (specified using SpringApplication.setDefaultProperties).</p>
  </blockquote>
  
  <p>Using something like this, I could make my own thing, picking properties from a file that's not committed, but I'm interested in following Spring Boot's best and common practices, not making my own; specially as I'm just getting started.</p>