You shouldn’t be hard-coding API keys, and definitely not committing them to the repository.
I guess it depends on who should have access to them, but at the company I work for, we keep all the private config files backed up in a secure place (local network server, encrypted cloud storage, whatever) and the config files are added to .gitignore. This is especially important for databases with personal info.
For local development you would definitely keep them in a config file. Nothing wrong with that.
For production they are set during the release process.
Nothing is more expensive than developers needing to find all the configs and keys to just start up a project to make a small fix somewhere.
A config file outside of the repository to be specific.
On Linux it can go somewhere under ~
On windows it can go somewhere in AppData
Ie; ~/YourAppName/Secrets.json or whatever your config file flavor is. Json, yaml, xml, whatevs
No. For development purposes I want my devs to be able to clone the repo and start.
So the development config files are inside the repositories.
Dear God. That’s like the first thing you’d test internally. We really do be moving fast, breaking things.