Safely storing an application's API keys

[Volker Krause]

On Montag, 18. Januar 2021 12:21:30 CET Jean-Baptiste Mardelle wrote:
> Hi all,
> 
> For Kdenlive, we are planning to expand the use of online services to
> download ambiance music or videos for use in personal projects. To this
> purpose, most online services provide us an API key that is used to
> identify our app (Kdenlive) when querying their API.
> 
> Does anyone have experience / advice on how to protect these API keys so
> that they are not publicly available ? Is there any KDE online service or
> framework helping to achieve that ?

We have a similar problem in KPublicTransport. As others said, I don't think 
keeping API keys secret is possible, they need to be handed out to the user 
eventually after all. This already doesn't really work for closed-source 
applications, and open source certainly doesn't make that any easier.

Terms of services requiring protection of API keys are IMHO therefore mostly 
wishful thinking. I have talked to the providers of two of the backends we use 
in KPublicTransport about this, they understand the problem and are ok with 
having the API keys in public source code. That might be the more realistic 
approach.

Regards,
Volker
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: This is a digitally signed message part.
URL: <http://mail.kde.org/pipermail/kde-devel/attachments/20210118/8bbae5b6/attachment.sig>