org-crypt key in .init file?

Question

I recently setup org-crypt to use my gpg key to encrypt headings in org-mode files. I post my .init files in a public github repo.

My question is: Is the key in (setq org-crypt-key "xxxxxxxx") actually my gpg secret key?

Did I just post my gpg secret key online?

I'm revoking the key, generating a new one, then encrypting that heading in my .init file just to be safe.

Answer 1

org-crypt-key is the GPG key identifier, normally an email address.

Your GPG secret key resides in the secret ring in your .gnupg directory, and is protected by your passphrase.

From the source code comments:

;; 2. Set the encryption key to use in the `org-crypt-key' variable,
;;    or use `M-x org-set-property' to set the property CRYPTKEY to
;;    any address in your public keyring.  The text of the entry (but
;;    not its properties or headline) will be encrypted for this user.
;;    For them to read it, the corresponding secret key must be
;;    located in the secret key ring of the account where you try to
;;    decrypt it.  This makes it possible to leave secure notes that
;;    only the intended recipient can read in a shared-org-mode-files
;;    scenario.
;;    If the key is not set, org-crypt will default to symmetric encryption.