CODEWITHSUNDEEP
securitytwitter
yyyyQqxKNqHyy
yyyyQqxKNqHyy

Reputation: 353

How do I include a Twitter API key in an open source desktop client while keeping it secret?

The API key and passcode have to be accessible to the source code in order for the application to be able to access the API, but can't be human readable, and there is only one API key for the whole application -- there isn't a key for every client. I've looked on Google and at similar questions here, but didn't find anything very useful.

Upvotes: 0

Views: 63

Answers (2)

DWRoelands
DWRoelands

Reputation: 4940

You can do what I did:

  1. Distribute your compiled binary with your keys compiled in.
  2. Distribute the source code with the keys removed, and include a readme explaining to developers that they need to get their own keys and their own Twitter application if they want to modify the source code.

It's not a great solution, but it's easier and more reasonable than creating an entire client-server architecture.

Upvotes: 0

Alex
Alex

Reputation: 21766

Typically the API key should be stored on a server you control. To access the API, your app needs to make a request to the server, which itself makes a request to the API, and then replies to your app with the information it retrieved from the API. You could limit access to your server by providing registered users with credentials to be entered during installation or alternatively/in addition you could limit access by IP range.

Upvotes: 1

Related Questions