Active key is stored in a secure way on Heroku's side and made available to the application via environment variables. You can read here about the security systems and processes that Heroku employs to make it one of the safest environments for hosting production apps: https://www.heroku.com/policy/security