 <p>Yes, storing this token into a config var is the right way to go.<br> As for <code>HEROKU_API_KEY</code>, this will happen because locally, the toolbelt will look for the environment variable as one solution to try to fetch your token.</p> <p>This won't impact your production environment (the heroku toolbelt isn't available within dynos).<br> Locally, you can also set it easily with a tool like <a href="https://github.com/theskumar/python-dotenv" rel="nofollow">python-dotenv</a>, which will allow you to have a local <code>.env</code> file (don't check it into source control, or your token could be corrupted), with all of it's values available as env vars in your dev app.</p>