diff --git a/watch-faces/complication/.gitignore b/watch-faces/complication/.gitignore
new file mode 100644
index 00000000..c33c0219
--- /dev/null
+++ b/watch-faces/complication/.gitignore
@@ -0,0 +1 @@
+totp_face.secrets.h
diff --git a/watch-faces/complication/totp_face.c b/watch-faces/complication/totp_face.c
index b45c62f6..d8ec461b 100644
--- a/watch-faces/complication/totp_face.c
+++ b/watch-faces/complication/totp_face.c
@@ -64,10 +64,14 @@ typedef struct {
 ////////////////////////////////////////////////////////////////////////////////
 // Enter your TOTP key data below
 
+#if __has_include("totp_face.secrets.h")
+#include "totp_face.secrets.h"
+#else
 static totp_t credentials[] = {
     CREDENTIAL(2F, "JBSWY3DPEHPK3PXP", SHA1, 30),
     CREDENTIAL(AC, "JBSWY3DPEHPK3PXP", SHA1, 30),
 };
+#endif
 
 // END OF KEY DATA.
 ////////////////////////////////////////////////////////////////////////////////
diff --git a/watch-faces/complication/totp_face.h b/watch-faces/complication/totp_face.h
index 0dc1b8e6..8628ff83 100644
--- a/watch-faces/complication/totp_face.h
+++ b/watch-faces/complication/totp_face.h
@@ -61,6 +61,10 @@
  *      o `algorithm` is one of the supported hashing algorithms listed above.
  *      o `timestep` is how often the TOTP refreshes in seconds. This is usually
  *        30 seconds.
+ *  o Alternatively, place the `credentials` variable as-is in a file named
+ *    `totp_face.secrets.h` in this directory, and it will be included instead.
+ *    This lowers the risk of commiting your OTP secrets to GitHub as that file
+ *    is listed in the .gitignore file.
  *
  * If you have more than one secret key, press ALARM to cycle through them.
  * Press LIGHT to cycle in the other direction or keep it pressed longer to