diff --git a/.gitignore b/.gitignore
index 171f0f3..8a96b58 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 .pio
 main/configuration.h
 main/credentials.h
+credentials-private.h
 
 # ignore vscode IDE settings files
 .vscode/*
@@ -8,4 +9,4 @@ main/credentials.h
 !.vscode/tasks.json
 !.vscode/launch.json
 !.vscode/extensions.json
-*.code-workspace
\ No newline at end of file
+*.code-workspace
diff --git a/main/credentials.h b/main/credentials.h
index 6d91159..656ff73 100644
--- a/main/credentials.h
+++ b/main/credentials.h
@@ -24,6 +24,9 @@ Credentials file
 
 #ifdef USE_OTAA
 
+#if 0
+    // copy these variables to ../credentials-private.h and customize with your secret appkey.
+    
     // This EUI must be in little-endian format, so least-significant-byte
     // first. When copying an EUI from ttnctl output, this means to reverse
     // the bytes. For TTN issued EUIs the last bytes should be 0x00, 0x00,
@@ -39,5 +42,6 @@ Credentials file
     // practice, a key taken from ttnctl can be copied as-is.
     // The key shown here is the semtech default key.
     static const u1_t PROGMEM APPKEY[16] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
+#endif 
 
 #endif
diff --git a/main/ttn.ino b/main/ttn.ino
index b760e1d..ad0aacc 100644
--- a/main/ttn.ino
+++ b/main/ttn.ino
@@ -31,6 +31,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #include "configuration.h"
 #include "credentials.h"
 
+// This file should not be in any publig git repos, it contains your secret APPKEY
+#include "../credentials-private.h"
+
 // -----------------------------------------------------------------------------
 // Globals
 // -----------------------------------------------------------------------------