Open Source Stack Exchange is a question and answer site for people organizing, marketing or licensing open source development projects. It only takes a minute to sign up.
Sign up to join this community
I have a project that I want to release as open source. However, the project interacts with some external web-based API that requires a key (issued by API owners specifically for the project), that should be kept in secret as said in the external API docs.
If I publish the project as is, I will show my key and, thus, it might get invalidated.
Is it legal to publish the project under open source license excluding the key?
If it is your project and doesn't include any external code, you can do what you want with it.
You can release it with a license that only allows near-sighted monkeys to use it while hanging from a tree. You can even publish the source under dozens of different licenses, each contradicting all others.
The license is only important if you gave the code to someone (e.g. by putting it on the web with some license and someone downloaded it). The one who GOT the software then has to conform to the license.
So for you this is only important, if you use code in your project you didn't create yourself. You then have to conform to all the licenses of the code you use.
Some licenses you might use have additional restrictions on the text of the license itself. Sometimes you cannot copy parts of the license text only or add additional clauses. I am not aware of any license that puts restrictions on the IP you license with it.
But no matter what license you release your code with, you still retain all rights. Even if you release your code with a AGPLv3 license, you can still make modifications, keep them closed, sell them, etc. as long as you don't use contributions from other people in your code. Otherwise the common practice of releasing code under some open source license while also selling commercial licenses wouldn't work.
Yes you can push a project without publishing the API key. Developers do it all the time.
Make sure you have prominent documentation explaining how other developers can acquire/install their own API key and make sure your source code detects a missing key and provides a helpful error message.
If you're using git, you can use a .gitignore file to prevent the API key from being included in the source code.
Your specific question seems to be:
Is it legal to publish the project under open source license excluding the key?
The answer is clearly: "yes".
I don even have an idea why anyone should think otherwise, but there is nothing in the open source licensing model that invalidates your use of the license if you exclude the API license key (or any other information that should be kept confidential, such as login credentials) from what you share.
It is not even considered problematic to exclude a valid API license key from the distribution of an open source project. For instance, there exist countless open source clients for web-services requiring API-keys that do this.
The standard solution is to ship the project with a dummy or no API key, and make provisions (for example during installation) for users to put in place their own, real, key.
As for making sure the key is excluded, there are many different ways to do this, depending on whether the key lives in a file of its own, or is part of some other file that is otherwise required. How to exclude it is IMHO outside the scope of this question.
(PS: My first reading of this question was that it was about whether it would be legal to include a valid key in the source code. Subsequent edits made it clear that is was really about whether it would be legal to publish the project under an open source license if the valid key where to be excluded from the source code.)
