We Want to Hear From You! What Do You Want to See on the Community? Tell us here!
Forum Discussion
Solved
How to store secret_id in Java desktop app
Hello,
As I want to deploy the next version of my Java desktop app with the integration of the Dropbox API so that users can have access to their dropbox folder within the program. For this, I will need to have my dropbox app client_id and secret_id in my Java code somewhere.
What are the recommendations and risks when dealing with client_id and secret_id in the compiled code ? While I plan on encoding them in base64 to make it a little harder to see when decompiling a jar, what is the best thing recommended ?
What are the risks of someone "seeing" my app client_id and secret_id ?
Thanks
Frederic
The app key, a.k.a. client ID, is public, and does not need to be hidden. The app secret a.k.a. client secret, should ideally be kept secret. (Leaking your app secret could let someone impersonate your app to an extent, though it wouldn't by itself enable access to any file data.)
Client-side apps fundamentally can't keep secrets. You can make it more difficult for someone to try to extract it, but you can't make it impossible. For this reason, client-side apps, such as a desktop app like you describe, ideally shouldn't contain the app secret at all. To process the OAuth app authorization flow without the app secret, client-side apps should use the "token" flow.
2 Replies
- Greg-DB
Dropbox Community Moderator
The app key, a.k.a. client ID, is public, and does not need to be hidden. The app secret a.k.a. client secret, should ideally be kept secret. (Leaking your app secret could let someone impersonate your app to an extent, though it wouldn't by itself enable access to any file data.)
Client-side apps fundamentally can't keep secrets. You can make it more difficult for someone to try to extract it, but you can't make it impossible. For this reason, client-side apps, such as a desktop app like you describe, ideally shouldn't contain the app secret at all. To process the OAuth app authorization flow without the app secret, client-side apps should use the "token" flow.
Thank you! I will use the implicit grant flow.
I apologize as I just realized that my question is a duplicate of this one. Feel free to delete mine if you need/want : https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/Proper-way-of-handling-APP-KEY-and-APP-SECRET/m-p/410478
About Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.
