cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Tell us what you want to see on the Community here!
Close

Dropbox API Support & Feedback

Find help with the Dropbox API from other developers.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Proper way of handling APP KEY and APP SECRET

Highlighted

Proper way of handling APP KEY and APP SECRET

Explorer | Level 4

Hi there, as per the title, if my application is to be shipped to the customer, how am I supposed to properly handle the use of APP_KEY and APP_SECRET in the app itself for authentication?

 

Currently, it is encoded in a base64 string and stored within the application itself and included in the headers. However, the user can relatively easily retrieve it if they want and impersonate my app. 

 

What would be the proper way of handling these information. Do I encrypt the base64 encoded string and store it in my app? Do I not include these in the app itself and find another way to obtain the APP_KEY and APP_SECRET?

1 Reply 1
Highlighted

Re: Proper way of handling APP KEY and APP SECRET

Dropboxer

The app key is considered public and does not need to be protected. The app secret should ideally be kept private though.

 

For server-side apps, such as web apps, this is possible since the app secret can be kept on the server only. In client-side apps, it's not possible to secure secrets unfortunately. Instead, you can avoid including the app secret entirely. For client-side apps, you can use the OAuth 2 "token" flow, which doesn't require the use of the app secret. You can find more information on that in the Dropbox OAuth 2 documentation.

Work Smarter with Dropbox

The way we work is changing. Share and discover new ways to work smarter with Dropbox in our community.

Sound good? Let's get started.
Who's talking

Top contributors to this post

What do Dropbox user levels mean?
Need more support?