git - How to hide files from getting pushed to Github but still have them push to Heroku -

sorry if stupid question.

i'm using oauth2 in heroku app has public github repo. if exclude file has oauth2 credentials via .gitignore, file still pushed heroku app? if not, what's ebst way keep credentials getting published on github, still have access them in heroku app?

use heroku app settings store credentials.

heroku config:set key=value 

and app has environment variable key specified value.

or if prefer can update them through heroku dashboard on 'settings' tab press 'reveal config vars' button , can edit config variables through web.