An app may need an API key to fetch data or generate a trivia question, but putting that key in public source code exposes it. In Streamlit, store local credentials in `.streamlit/secrets.toml` and read them through `st.secrets` instead. section 5.3.4 section 9.2.6
Create a `.streamlit` directory in the app’s root folder, then add `secrets.toml` inside it. TOML is a readable configuration format built around key–value pairs. A section such as `[jokes_api]` groups values; `st.secrets["jokes_api"]["api_key"]` retrieves its `api_key`. A value without a section can be read directly, as in `st.secrets["llm_api_key"]`. Run the app from its directory so Streamlit can find `.streamlit`. section 5.3.4 section 9.2.6
Listing 5.2 The secrets.toml file
[jokes_api] api_key = "+4VJR..."
This small file shows how a TOML section groups an API key without placing the key in application code. section 5.3.4
Keep local and deployed secrets separate:
- Do not commit `secrets.toml`; add it to `.gitignore` to help prevent accidents. section 5.5
- For Streamlit Community Cloud, paste the local file’s contents into the app’s Settings → Secrets field and save. A deployed database app may also need its local connection string replaced with the production one. section 5.4.3 section 8.6.2
- For BigQuery service-account credentials, convert the downloaded JSON credentials to TOML under a `[bigquery]` section; keep those credentials secret because they permit access to the data. section 7.7.2
The deployment environment determines how the file reaches the app. A local Docker Compose setup can mount `.streamlit` into its container. Elastic Beanstalk cannot rely on placing that local directory on its server, so the demonstrated setup uses `.ebextensions` to create a server-side `secrets.toml` and mounts that directory into the container. section 12.3.5
