API keys should not be saved in Configuration API

Patch file.

Typo fixed.

I am not sure what to make of this.

1. The patch gives me an error:

Error: Call to undefined function Drupal\media_entity_unsplash\unsplashGetKey() in Drupal\media_entity_unsplash\UnsplashFetcher->__construct() (line 38 of modules/contrib/media_entity_unsplash/src/UnsplashFetcher.php).

2. In general the patch does a lot of things that at first sight I do not understand. Can you explain what the plan is?

3. I see more issues like this one, but opinions are divided on the solution:
#3002335: Google keys are stored in configuration API instead of states API →
#3188349: Save API Token to state →

Let me know what you think

1. Must be something I overlooked.

2. Well, first, the keys should not be in config/install/media.type.unsplash.yml file because that goes to Config. Then, some helper functions (e.g. unsplashGetKey and others) and then at the end, changes for the unsplash library because the library does not use access_key or secret_key, it uses applicationId, secret and utmSource as required keys when making call.

3. The links you gave offer the same solution: State API, which is what I'm doing, too.

Keys should indeed be stored in the State system, this way they are 1) not exported to a file and 2) can differ per environment.

The patch does not apply anymore.

As mentioned in #4 it contains changes that are out of scope.

I've updated the patch to include only the State API changes.

Patch was incomplete, updated it.

Another error fix, updated patch.

Typos fixed, patch updated.

Ok, the patch is all good to go.

After applying the patch to the latest module version with composer.json, I fixed all the remaining errors when it gets applied and finally it's ready to use.

I gave this a bit more thought and I agree with the conclusions in #3002335: Google keys are stored in configuration API instead of states API → (comment #9) and #3188349: Save API Token to state → (comment #4): the API keys should stay in config and not be stored in state.

A module like Key → can be used to secure them.

Users that prefer the keys to be stored in state can use the patch.

I close this issue now. Feel free to re-open if you think it is necessary.