# How would I hide my files?
**URL:**
**Author:**  [@un-index](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fun-index)%5C
**Post date:** [December 22, 2021, 12:15pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fhow-would-i-hide-my-files%2F13035%2F1 "2021-12-22T12:15:31Z")
I need to include my API key to use the inference API, but how do I do that without making my key publicly visible in my space’s files?
I don’t want to make it private.
---
**Author:**  [@osanseviero](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fosanseviero)%5C
**Post date:** [December 22, 2021, 1:27pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fhow-would-i-hide-my-files%2F13035%2F2 "2021-12-22T13:27:05Z")
You can add [secrets](https://huggingface.co/docs/hub/spaces#manage-secrets) to have access to variables such as API keys in your Space 🙂
> If your app requires secret keys or tokens, don’t hard-code them inside your app! Instead, go to the **Settings** page of your Space repository and enter your secrets there. The secrets will be exposed to your app with [Streamlit Secrets Management](https://blog.streamlit.io/secrets-in-sharing-apps/) if you use Streamlit, and as environment variables in other cases.
---
**Author:**  [@BramVanroy](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FBramVanroy)%5C
**Post date:** [December 22, 2021, 1:42pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fhow-would-i-hide-my-files%2F13035%2F3 "2021-12-22T13:42:02Z")
Out of curiosity, are these “secrets” accessible at all by moderators/Hugging Face in plain text? Or are they at least hashed and protected?
---
**Author:**  [@osanseviero](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fosanseviero)%5C
**Post date:** [December 22, 2021, 1:46pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fhow-would-i-hide-my-files%2F13035%2F4 "2021-12-22T13:46:25Z")
I cannot even see the values of my own secrets 😅 these are hashed and protected as far as I know, but I’ll let @cbensimon give a final confirmation.
---
**Author:**  [@un-index](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fun-index)%5C
**Post date:** [December 22, 2021, 2:32pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fhow-would-i-hide-my-files%2F13035%2F5 "2021-12-22T14:32:50Z")
so if I added a secret under “API\_TOKEN” , I’d do something like:
```python
import os
os.environ.getattribute("API_TOKEN")
```
---
**Author:**  [@osanseviero](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Fosanseviero)%5C
**Post date:** [December 22, 2021, 2:58pm UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fhow-would-i-hide-my-files%2F13035%2F6 "2021-12-22T14:58:01Z")
Yes, that looks good! Or `os.environ["API_TOKEN"]` should work as well. You can try it out with a dummy token first, print the value, and see it in the logs (click in “Running”)