I am developing a PHP-based HOD Leave Approval system on my free hosting account.
I have enabled the Google Sheets API and created a Google Cloud service account. I need to store its JSON private key securely so PHP can access my Google Sheet.
My File Manager opens inside /htdocs, and I cannot identify a directory outside the public web root.
Does my hosting account support storing private files outside /htdocs, or is there another recommended secure method for storing service-account credentials?
On free hosting your files live inside htdocs, so the practical approach is to keep the key inside it but make sure it can never be served to a browser. Two simple options, and you can use both together:
1. Put the key in a protected folder
Create a folder like htdocs/private/, upload the JSON file there, and add a .htaccess file in that folder containing:
Require all denied
Any direct request to that folder will be blocked, while your PHP scripts can still read the file normally from the server side.
2. Store the credentials in a .php file instead of .json
Rename the file to something like credentials.php and wrap the contents so it returns the data:
Then load it with $creds = require __DIR__ . '/private/credentials.php';. Even if someone found the URL, PHP would execute the file and output nothing.
A couple of extra tips: use a random, non-obvious folder name, never commit the key to a public repo, and give the service account access only to the one sheet it needs. If the key is ever exposed, delete it in Google Cloud and generate a new one.
Please note we can’t assist further with custom code or the Google API integration itself, but the steps above should keep your key safe on our platform.