Hide API key / files in Github but not Heroku
You can't ignore a file and also push it to GitHub, since that would require it to be committed. Git's ignore system only prevents files from being tracked. If you commit it, it won't be ignored anymore.
Instead of loading it from a file, pull your API key in from the environment, which is Heroku's recommended best practice. Exactly how you retrieve this value depends on the language and possibly framework that you're using, but you can set it using heroku config, e.g.
heroku config:set API_KEY=some-keyThis just sets an environment variable, so if you search for "your-language read environment variable" you should find good documentation on how to read the value. A Python example might look like
import osapi_key = os.getenv("API_KEY", "optional-default")