Distribution of Application API Token

Question

I wrote a simple twitter client for command-line use. For such application, twitter requires two types of tokens, namely

• application identification,
• user OAuth Token.

The second one is to allow the user to connect to their account, and the first one is in principle to identify the developper/application for twitter.

So far, I have distributed (well placed on github) only the code without any token. The User tokens is clear, it is up to the end-user to authorize the access to their account.

The problem that I have is for the application identification token. So far, I require that the end user register an application themselves, take that token, and use the code. I am afraid that having it directly available, people could take it, use it in another application and abuse the Twitter API. But that has a complexity cost for the end-user.

How should I share/organise the application identification that is both secure for the developper and simple for the user?

Answer 1

Your problem is not secret sharing; it's more philosophical in terms of how systems are designed.

If what you have is a CLI application that you have to have on your system and, itself, contacts the Twitter API directly, then you'll never be able to "hide" this application ID token. You either have to accept the risk and give your ID, or the end-users have to register their own. There's no third option.

The alternative solution would be that you host the main application as a server-side component that you (or your "middle-users") keep on a server. There you can keep this application ID token. The CLI application would be used by your end-users as a client that interacts with this server component, and the server part interacts with the Twitter API using the user-provided token and your own application ID token.