How to store secret_id in Java desktop app

Question

Hello,

As I want to deploy the next version of my Java desktop app with the integration of the Dropbox API so that users can have access to their dropbox folder within the program. For this, I will need to have my dropbox app client_id and secret_id in my Java code somewhere.

What are the recommendations and risks when dealing with client_id and secret_id in the compiled code ? While I plan on encoding them in base64 to make it a little harder to see when decompiling a jar, what is the best thing recommended ?

What are the risks of someone "seeing" my app client_id and secret_id ?

Thanks

Frederic

Greg-DB · Accepted Answer

The app key, a.k.a. client ID, is public, and does not need to be hidden. The app secret a.k.a. client secret, should ideally be kept secret. (Leaking your app secret could let someone impersonate your app to an extent, though it wouldn't by itself enable access to any file data.)

Client-side apps fundamentally can't keep secrets. You can make it more difficult for someone to try to extract it, but you can't make it impossible. For this reason, client-side apps, such as a desktop app like you describe, ideally shouldn't contain the app secret at all. To process the OAuth app authorization flow without the app secret, client-side apps should use the "token" flow.