5 ms·
You don't have to return the API keys to the user's phone. You could set up a proxy API that will call the third-party service on behalf of an authenticated use
by kranner 10y ago
You don't have to return the API keys to the user's phone. You could set up a proxy API that will call the third-party service on behalf of an authenticated user.
- izacus 10y agoIsn't that what OAuth keys are explicitly there to PREVENT? Letting application developers unlimited access to your accounts on their backend servers.
- kranner 10y agoI didn't mean this for scenarios where the user has an account with private content with the third party (e.g. Twitter), but for e.g. a common backend resource such as sending an error report to developers for user-facing errors.
- richard_taylor 10y agoFull disclosure, I work for a company called CriticalBlue that helps customers with these types of issues. We have a recent blog article about setting up a proxy for API keys in this way that might be useful at https://www.approov.io/blog/protect-your-api-keys-with-approov.html https://www.approov.io/blog/protect-your-api-keys-with-appro... . We have a way of then locking down that proxy so only approved apps can use it - without simply circling back to the original problem of hiding secrets in apps.