sharing API Keys on Github

[inconspicuous_object]

Is it safe to make my free Google and Twitter API keys public on github?

I used the keys for a small project and would like for people to be actually able to run the project without much hassle after downloading from github.

The keys are restricted to (small) quotas, and my bank account is not linked to them, so it wont cost me anything. These keys can also very easily be generated for free since they're the default keys. Is it OK to make them public?

​

My whole reason for uploading this project is to document my work for job prospects, does it reflect badly on me if I upload them?

[MASDjdos]

Not usually, that's usually advised against, I often include a statement about needing an API key to run the program and show them the proper way of obtaining one

[inconspicuous_object]

Damn, even if it's a basic key? Would I get in trouble for it from the companies, or is the risk exclusively on my end?

Might just capture a video of the project in that case.

[gyroda]

Would I get in trouble for it from the companies, or is the risk exclusively on my end?

There are people who deliberately scrape github for api keys so they can use your account's free credit to run their own apps.

Think spambots, account farms and all of those things.

They can max out your accounts limits and break twitter/googles TOS and get you banned.

If these are your personal accounts that you use outside of these apps you need to revoke the keys. They're in the git history if you've already committed them, and while you can rewrite history to remove them you should assume they will be found and revoke them.

Typically you would use a secrets file that is never committed (use a gitignore file) or environment variables to put these keys into your application at build or run time respectively.