# Adding/overwriting configuration files (secrets, gitignored, not in repository)

**URL:** <https://discuss.bitrise.io/t/adding-overwriting-configuration-files-secrets-gitignored-not-in-repository/301>\
**Category:** Question & Answer\
**Created:** [January 16, 2017, 11:33am UTC](https://discuss.bitrise.io/t/adding-overwriting-configuration-files-secrets-gitignored-not-in-repository/301 "2017-01-16T11:33:44Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![viktorbenei](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.bitrise.io/viktorbenei/32/18_2.png) [@viktorbenei](https://discuss.bitrise.io/u/viktorbenei)\
**Post date:** [January 16, 2017, 1:08pm UTC](https://discuss.bitrise.io/t/adding-overwriting-configuration-files-secrets-gitignored-not-in-repository/301/2 "2017-01-16T13:08:42Z")

</div>

Hi @dawidfiruzek 👋 🙂

> [@dawidfiruzek](#):
>
> I have confidential info - api endpoints, tokens etc. that I do not want to include in my github repo.

In general the solutions (might be others too, if anyone have any additional note just let us know!):

1. Use a secondary repository to store your secrets in, and `git clone` that with a **Script** step for example (if you’d want to do this please [make sure that the same SSH key can be used for both repos!](http://devcenter.bitrise.io/faq/adding-projects-with-submodules/))
2. Use **App Env Vars** or **Secret Env Vars** on [bitrise.io](https://www.bitrise.io) - you can find these in the Workflow Editor (`Workflow` tab of your app on [bitrise.io](https://www.bitrise.io)). The variables you define here are regular environment variables, so you can use them any way you like, e.g. with a **Script** step, writing into a file.
3. Use the [Generic File Storage](http://devcenter.bitrise.io/tutorials/how-to-use-the-generic-file-storage/) feature of [bitrise.io](https://www.bitrise.io), upload your file(s) and download it using the **File Downloader** or **ZIP resource archive downloader** step.

These are just the highlights of the main solutions of course, there are other possible ways if you’re more adventurous, e.g. store the file encrypted in your repository, store the encryption key in an **App Env Var** or **Secret Env Var** on [bitrise.io](https://www.bitrise.io) and decrypt the file during the build.

If you have any questions, just let us know!

---

_[View the full topic](https://discuss.bitrise.io/t/adding-overwriting-configuration-files-secrets-gitignored-not-in-repository/301)._