title: Where should I place the secret key in Flask?
body: <p>While reading <a href="https://exploreflask.com/configuration.html" rel="noreferrer">exploreflask.com</a>, I learned that it is best practice to use two different config files, one for development and one for production. I don't understand whether to place the secret key inside of the development or production config.</p>
  
  <blockquote>
    <p>The private nature of the instance folder makes it a great candidate for defining keys that you don’t want exposed in version control. These may include your app’s secret key or third-party API keys.</p>
  </blockquote>
  
  <p>I suppose the secret key shouldn't be shared.  Should I put the secret key in the development config or the production config, or should I have a different key for each config?</p>