You might see that the Dropbox Community team have been busy working on some major updates to the Community itself! So, here is some info on what’s changed, what’s staying the same and what you can expect from the Dropbox Community overall.
Forum Discussion
How to store secret_id in Java desktop app
Hello,
As I want to deploy the next version of my Java desktop app with the integration of the Dropbox API so that users can have access to their dropbox folder within the program. For this, I will need to have my dropbox app client_id and secret_id in my Java code somewhere.
What are the recommendations and risks when dealing with client_id and secret_id in the compiled code ? While I plan on encoding them in base64 to make it a little harder to see when decompiling a jar, what is the best thing recommended ?
What are the risks of someone "seeing" my app client_id and secret_id ?
Thanks
Frederic
The app key, a.k.a. client ID, is public, and does not need to be hidden. The app secret a.k.a. client secret, should ideally be kept secret. (Leaking your app secret could let someone impersonate your app to an extent, though it wouldn't by itself enable access to any file data.)
Client-side apps fundamentally can't keep secrets. You can make it more difficult for someone to try to extract it, but you can't make it impossible. For this reason, client-side apps, such as a desktop app like you describe, ideally shouldn't contain the app secret at all. To process the OAuth app authorization flow without the app secret, client-side apps should use the "token" flow.
- Greg-DB
Dropbox Staff
The app key, a.k.a. client ID, is public, and does not need to be hidden. The app secret a.k.a. client secret, should ideally be kept secret. (Leaking your app secret could let someone impersonate your app to an extent, though it wouldn't by itself enable access to any file data.)
Client-side apps fundamentally can't keep secrets. You can make it more difficult for someone to try to extract it, but you can't make it impossible. For this reason, client-side apps, such as a desktop app like you describe, ideally shouldn't contain the app secret at all. To process the OAuth app authorization flow without the app secret, client-side apps should use the "token" flow.
Thank you! I will use the implicit grant flow.
I apologize as I just realized that my question is a duplicate of this one. Feel free to delete mine if you need/want : https://www.dropboxforum.com/t5/Dropbox-API-Support-Feedback/Proper-way-of-handling-APP-KEY-and-APP-SECRET/m-p/410478
About Dropbox API Support & Feedback
Find help with the Dropbox API from other developers.
