I like the solution I stole from rstat.us: you have an off-repository location for the token If there's none: * on production you crash, * on dev, you autogen

I like the solution I stole from rstat.us: you have an off-repository location for the token If there's none: * on production you crash, * on dev, you autogenerate one and save it to a config file that's possibly dev-only, * during automated tests you just autogenerate something and live with it. Here's the nice replacement for secret_token.rb: https://github.com/hotsh/rstat.us/blob/master/config/initializers/secret_token.rb https://github.com/hotsh/rstat.us/blob/master/config/initial...