I have a JS app - a newsletter signup form using mailchimp. It requires mailchimp api key and audience key which I had included in the app. I uploaded to github and that updates heroku and the app worked fine on heroku, briefly. Then mailchimp emailed me to say they had detected I had made api key public so disabled it. Git repository is public - guess I could make private as an option.

I figured I could put the keys into a config.json file and have the script get the info from there. Thats what I tried and put that filename into .gitignore so this would not go to github. However since heroku updates from github, it cant find the config.json file. If I dont put that file into .gitignore then the config.json file will be on github and again my api key will be public.

What should I be doing to keep api keys confidential while still being able to use github to update heroku?