I have a project that I want to release as open source. However, the project interacts with some external web-based API that requires a key (issued by API owners specifically for the project), that should be kept in secret as said in the external API docs.

If I publish the project as is, I will show my key and, thus, it might get invalidated.

Is it legal to publish the project under open source license excluding the key?

  • I'm just going to make a point that questions seeking legal advice are off-topic here at Open Source. I'll give you some thoughts on the question: I would recommend that you focus more on the key, rather than the legal implications of it. I personally don't have much of an issue with the question as is, but I wouldn't be so sure of others in the community - they have a say on these issues too. :)
    – Zizouz212
    Jul 22, 2015 at 23:02
  • 6
    Note that you should never include API keys like this in your source code. Put them in a config file or use an environment variable. If you use a config file, make sure your version control system will ignore the file. Jul 23, 2015 at 1:14

3 Answers 3


If it is your project and doesn't include any external code, you can do what you want with it.

You can release it with a license that only allows near-sighted monkeys to use it while hanging from a tree. You can even publish the source under dozens of different licenses, each contradicting all others.

The license is only important if you gave the code to someone (e.g. by putting it on the web with some license and someone downloaded it). The one who GOT the software then has to conform to the license.

So for you this is only important, if you use code in your project you didn't create yourself. You then have to conform to all the licenses of the code you use.

Some licenses you might use have additional restrictions on the text of the license itself. Sometimes you cannot copy parts of the license text only or add additional clauses. I am not aware of any license that puts restrictions on the IP you license with it.

But no matter what license you release your code with, you still retain all rights. Even if you release your code with a AGPLv3 license, you can still make modifications, keep them closed, sell them, etc. as long as you don't use contributions from other people in your code. Otherwise the common practice of releasing code under some open source license while also selling commercial licenses wouldn't work.


Yes you can push a project without publishing the API key. Developers do it all the time.

Make sure you have prominent documentation explaining how other developers can acquire/install their own API key and make sure your source code detects a missing key and provides a helpful error message.

If you're using git, you can use a .gitignore file to prevent the API key from being included in the source code.

  • In this vein of thought, environment variables are often a convenient (and safer) way to do this. Just one slip up can put that secret file in your repo's history. That can't happen with an env variable.
    – RubberDuck
    Aug 28, 2015 at 1:06

Your specific question seems to be:

Is it legal to publish the project under open source license excluding the key?

The answer is clearly: "yes".

I don even have an idea why anyone should think otherwise, but there is nothing in the open source licensing model that invalidates your use of the license if you exclude the API license key (or any other information that should be kept confidential, such as login credentials) from what you share.

It is not even considered problematic to exclude a valid API license key from the distribution of an open source project. For instance, there exist countless open source clients for web-services requiring API-keys that do this.

The standard solution is to ship the project with a dummy or no API key, and make provisions (for example during installation) for users to put in place their own, real, key.

As for making sure the key is excluded, there are many different ways to do this, depending on whether the key lives in a file of its own, or is part of some other file that is otherwise required. How to exclude it is IMHO outside the scope of this question.

(PS: My first reading of this question was that it was about whether it would be legal to include a valid key in the source code. Subsequent edits made it clear that is was really about whether it would be legal to publish the project under an open source license if the valid key where to be excluded from the source code.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.