How to Handle Special Characters in Passwords and API Keys for InternetIncome Apps

Wrap all credentials in single quotes inside properties.conf to prevent shell interpretation and ensure Docker receives the exact literal values.

The InternetIncome automation framework (available at engageub/internetincome) manages multiple passive income applications through Docker containers. All sensitive credentials—including passwords, API keys, and authentication tokens—are centralized in the properties.conf file. Because the main orchestration script internetIncome.sh injects these values directly into Docker run commands as environment variables, unescaped special characters can trigger shell expansion or cause command syntax errors.

Why Special Characters Break InternetIncome Deployments

When internetIncome.sh launches containers, it constructs Docker commands using variable expansion (e.g., -e HONEYGAIN_PASSWORD=$HONEYGAIN_PASSWORD). The shell processes this expansion before passing the value to Docker. If your password contains characters like $, &, ", ', or spaces, the shell interprets them as operators or delimiters, truncating the value or executing unintended commands.

The framework explicitly warns users about this behavior in the documentation:

When setting your email, password, or token, always place them between single quotes ('') to consider special characters. (README.md line 105)

The Single-Quote Solution in properties.conf

The definitive method to handle special characters in passwords and API keys for InternetIncome apps is wrapping every credential value in single quotes within properties.conf. This technique leverages POSIX shell behavior to protect literal strings.

How Single Quotes Protect Your Credentials

Bash treats text enclosed in single quotes as a literal string, disabling:

• Variable expansion ($VAR remains $VAR rather than expanding)
• Command substitution (backticks or $(cmd) are ignored)
• Globbing (wildcards like * are treated as characters)

When internetIncome.sh sources properties.conf using the source command, the variables retain their exact literal values. When these variables are later expanded in Docker commands, the shell passes the unaltered string to the container.

# Correctly formatted properties.conf

DEVICE_NAME='ubuntu'
HONEYGAIN_EMAIL='user@example.com'
HONEYGAIN_PASSWORD='p@$$w0rd!&*'          # $ and & are safe inside single quotes

ANTGAIN_API_KEY='abcd1234-efgh-5678-ijkl' # hyphens are fine

UR_AUTH_TOKEN='eyJhbGciOiJIUzI1NiIsInR5...==' # trailing == preserved

Handling Edge Cases and Escape Sequences

While single quotes solve most special character issues, certain characters require specific escaping techniques when they appear inside passwords or API keys.

Passwords Containing Single Quotes

If your credential contains a literal single quote character ('), you cannot simply wrap it in single quotes. You must close the quote, insert an escaped single quote, and reopen the quote.

# Password: pass'word

PASSWORD='pass'\''word'

# Explanation:

# 'pass'  -> literal "pass"

# \'      -> escaped single quote

# 'word'  -> literal "word"

Dollar Signs and Variable Expansion

Dollar signs ($) commonly appear in generated passwords and API keys. Without single quotes, the shell attempts to expand $ as a variable reference, often resulting in empty strings.

# Incorrect - $5 would try to expand to the 5th positional parameter

PASSWORD=p@$$word

# Correct - literal dollar signs preserved

PASSWORD='p@$$word'

Backslashes and Double Quotes

Backslashes (\) and double quotes (") are preserved literally inside single quotes without additional escaping.

# Password: pa"ss\word

PASSWORD='pa"ss\word'  # Works correctly

Technical Implementation in internetIncome.sh

The credential handling logic resides in internetIncome.sh, specifically around lines 820-830 where Docker containers are instantiated. The script checks for the presence of credentials and injects them using the -e flag.

# Fragment from internetIncome.sh (lines ~820-830)

if [[ $HONEYGAIN_EMAIL && $HONEYGAIN_PASSWORD ]]; then
  sudo docker run -d --name honey${UNIQUE_ID}$i $NETWORK_TUN $LOGS_PARAM $DNS_VOLUME \
    --restart=always $honeygain_image -tou-accept \
    -email $HONEYGAIN_EMAIL -pass $HONEYGAIN_PASSWORD -device $DEVICE_NAME$i
fi

Because the variables are expanded by the shell during command construction, the single-quote wrapping in properties.conf ensures that Docker receives the complete, unmodified credential string. This architecture applies uniformly across all supported applications including Honeygain, BitPing, IPRoyal, and others.

Summary

• Always wrap credentials in single quotes inside properties.conf to prevent shell interpretation of special characters.
• Escape single quotes within passwords by closing the quote, adding \', and reopening: 'pass'\''word'.
• Dollar signs, ampersands, and backslashes are preserved literally when enclosed in single quotes.
• The internetIncome.sh script sources these variables and injects them into Docker containers, relying on proper quoting to maintain credential integrity.

Frequently Asked Questions

What happens if I don't use single quotes in properties.conf?

Without single quotes, the shell interprets special characters during variable assignment or Docker command expansion. Characters like $ trigger variable expansion, & backgrounds the process, and spaces split the value into separate arguments. This results in truncated credentials or authentication failures in applications like Honeygain or BitPing.

How do I escape a single quote inside my password?

Since single quotes cannot contain literal single quotes, you must close the current quote, insert an escaped single quote, and reopen the quoting. For a password pass'word, write: PASSWORD='pass'\''word'. The sequence \' produces a literal single quote, and the surrounding single quotes maintain the literal interpretation of the rest of the string.

Are double quotes safe to use instead of single quotes?

Double quotes allow variable expansion and command substitution, making them unsafe for credentials containing $, backticks, or exclamation marks. While double quotes protect spaces and some special characters, they do not provide the literal guarantees required for complex API keys and passwords. Always use single quotes as specified in the InternetIncome documentation.

Does this affect all InternetIncome apps equally?

Yes, the credential handling mechanism is universal across all supported applications. Whether configuring Honeygain, BitPing, IPRoyal, AntGain, or UserRoyals, the properties.conf file uses the same sourcing mechanism and Docker injection method. All credentials must follow the single-quote convention regardless of which specific app they authenticate.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}