cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Want to learn some quick and useful tips to make your day easier? Check out how Calvin uses Replay to get feedback from other teams at Dropbox here.

Dropbox API Support & Feedback

Find help with the Dropbox API from other developers.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to store secret_id in Java desktop app

How to store secret_id in Java desktop app

FJBDev
Helpful | Level 5
Go to solution

Hello,

 

As I want to deploy the next version of my Java desktop app with the integration of the Dropbox API so that users can have access to their dropbox folder within the program. For this, I will need to have my dropbox app client_id and secret_id in my Java code somewhere.

What are the recommendations and risks when dealing with client_id and secret_id in the compiled code ? While I plan on encoding them in base64 to make it a little harder to see when decompiling a jar, what is the best thing recommended ?

What are the risks of someone "seeing" my app client_id and secret_id ?

 

Thanks

Frederic

1 Accepted Solution

Accepted Solutions

Greg-DB
Dropbox Staff
Go to solution

The app key, a.k.a. client ID, is public, and does not need to be hidden. The app secret a.k.a. client secret, should ideally be kept secret. (Leaking your app secret could let someone impersonate your app to an extent, though it wouldn't by itself enable access to any file data.)

 

Client-side apps fundamentally can't keep secrets. You can make it more difficult for someone to try to extract it, but you can't make it impossible. For this reason, client-side apps, such as a desktop app like you describe, ideally shouldn't contain the app secret at all. To process the OAuth app authorization flow without the app secret, client-side apps should use the "token" flow.

View solution in original post

2 Replies 2

Greg-DB
Dropbox Staff
Go to solution

The app key, a.k.a. client ID, is public, and does not need to be hidden. The app secret a.k.a. client secret, should ideally be kept secret. (Leaking your app secret could let someone impersonate your app to an extent, though it wouldn't by itself enable access to any file data.)

 

Client-side apps fundamentally can't keep secrets. You can make it more difficult for someone to try to extract it, but you can't make it impossible. For this reason, client-side apps, such as a desktop app like you describe, ideally shouldn't contain the app secret at all. To process the OAuth app authorization flow without the app secret, client-side apps should use the "token" flow.

FJBDev
Helpful | Level 5
Go to solution

Thank you! I will use the implicit grant flow.

 

I apologize as I just realized that my question is a duplicate of this one. Feel free to delete mine if you need/want : https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/Proper-way-of-handling-APP-KEY-and-APP-...

Need more support?
Who's talking

Top contributors to this post

  • User avatar
    FJBDev Helpful | Level 5
  • User avatar
    Greg-DB Dropbox Staff
What do Dropbox user levels mean?