Opinions sought on best practice

Weblog is essentially a bunch of wrappers for other API's. That means we have a lot of external keys
we have to handle - e.g. if you're going to use a google map you have to provide them a map key.

Currently we have checked in a googlemapkey.pl.example file that has a few lines of comment saying where
to get the API and a single line that defines the key, with  PUT THE KEY HERE in it.

Obviously we don't have googlemapkey.pl checked in because it contains a password (the map key).
We don't want to hand out our keys, and don't want to clobber others keys with ours when they update weblog.

Presumably this ends up in a settings file, but I'm unsure what best practice is here.

Should there be a settings file for each item, or a single settings file, with each one loaded only as it's 
associated widget file is loaded (eg the google maps key is loaded with google maps, the stormpath key with stormpath)?

And whats the proper way of using default settings and of handling an undefined setting? Currently I have
an unlikely value like this_is_not_the_key as the default and check for it, but am uncomfortable with that.

(The UX is pretty settled - it substitutes an inclusion that says there's a missing key and has a button to the page to get it).