3 ms·

If your code integrates with third party services often you'll need an api key, or sometimes client id and secrets for authentication.

• globular-toast 2y ago
  That doesn't explain anything. I didn't ask why people need secrets, I asked why you need shared secrets. Your production deployment is what needs access to the third party services, not "the code". Developers shouldn't be accessing these services from dev instances. Developers should get their own credentials or use some kind of staging service which can be shared, but isn't secret.
  • willcipriano 2y ago
    Tell me you've never worked with a third party API without telling me you haven't worked with a third party API. Generally speaking they aren't willing to make accounts for each dev on your team and manage that on their end. You might have a test env, but the creds for it are still secret for many reasons.
    • globular-toast 2y ago
      Of course I've worked with third party APIs. What ones don't let you make dev accounts? Do you really give devs the prod credentials for these services?
      • willcipriano 2y ago
        In every organization I've worked in, if the devs didn't have the production creds nothing would get shipped. Google, Facebook, etc do with 100 people what normal companies do with 2.