What is the best place to store app variables?

Hi,
I am wondering what is the best practice to store app variables? For example API keys.

• Is it in the app/Config/Constants.php file?
  
• Or directly into the Controller where you use them?
  
• Or is it in the .env file and then you can access it using getenv() where you need it?
  

I am working on implementing the Stripe payment and I have found tutorials that either create a constant, or put the keys directly into the controller and I wonder if there is a reason for choosing one or the other? 
The idea to put them into .env is an added thought for the case when for instance, you need a different value depending on your environnement. I use in my projects env-staging and env-production to store some already, and depending on where I deploy, I create the .env file from one or the other. 
Thanks for sharing your thoughts

You should set the secret keys in Environment Variables.

If you set in app/Config/Constants.php or Controllers, all the people who can access the source code
can get the secret keys.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

If you set in app/Config/Constants.php or Controllers, all the people who can access the source code
can get the secret keys.

Oh that's indeed a good point. Thanks

You should set the secret keys in Environment Variables.

If you set in app/Config/Constants.php or Controllers, all the people who can access the source code
can get the secret keys.

But won't the same hacker have access to the .env file?

You should set the secret keys in Environment Variables.

If you set in app/Config/Constants.php or Controllers, all the people who can access the source code
can get the secret keys.

But won't the same hacker have access to the .env file?

If CI has been installed the correct way a .env file is just as save, the main difference is if the .env is publicly available it's readable PHP cannot be read by default (still possible with wrong configuration on server) it's processed.

You don't need to use .env file. You need to set environment variables.
If you don't use .env file, the hacker cannot read .env file.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

@kenjis how do you do that without using .env file? I am a bit confused with that option

Set environment variables on your server.

For example, on heroku you can set them from CLI command or Dashboard:
https://devcenter.heroku.com/articles/co...onfig-vars

Environment variables were used before .env file was invented.
.env file is a way to set environment variables easily for developers.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

I see. Thanks