Laravel external API password handling [duplicate] - laravel

Question

This question already has answers here:
Where API credentials should be stored in laravel?
(2 answers)
Closed 4 months ago.
I am wiring an laravel web application for a small project.
One of the features is to access the API of a foto database (piwigo).
I am very new to laravel and have 0 experience in web security so I was wondering what is the best way to set it up.
I managed to setup the API access trough laravel by creating a PiwigoClient model with a login method, that will pass the response coockies to other request to piwigo:
class PiwigoClient extends Model
{
use HasFactory;
public static $apiURL = 'https://not-actual-piwigo-link/ws.php';
public function login() {
$response = Http::asForm()
->post($this::$apiURL . '?format=json', [
'method' => 'pwg.session.login',
'username' => 'UserName',
'password' => 'PassWord'
]);
return $response;
}
public function test() {
$login = $this->login();
$cookies = $login->cookies();
$response = Http::withOptions(['cookies' => $cookies])
->get($this::$apiURL, [
'format' => 'json',
'method' => 'pwg.tags.getImages',
'tag_name' => 'ImageTag'
]);
return $response->json();
}
}
Now I was wondering, it does not feel safe to leave the 'PassWord' like this in the PiwigoClient model file. What would be the safest and most convenient way to "store" the password?

Answer 1

Standard practices are to store "secret" keys in .env and then reference them in your codebase via a config file.
https://laravel.com/docs/9.x/helpers#method-config
// PiwigoClass
public function login() {
$response = Http::asForm()
->post(config('piwigo.url') . '?format=json', [
'method' => 'pwg.session.login',
'username' => config('piwigo.username'),
'password' => config('piwigo.password')
]);
return $response;
}
// config file piwigo.php
<?php
return [
'password' => env('PIWIGO_PASSWORD', 'PassWord'),
'username' => env('PIWIGO_USERNAME', 'UserName'),
'url' => env('PIWIGO_URL', 'https://my_api_url...')
]
?>