In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are able to access the data from the API using OAuth.

My concern is how to properly store application's own client_id and client_secret. The application is built with Python 3 + Flask. Currently there is a JSON file in the server that stores the credentials in plain text:


    "CLIENT_SECRET": "<value>",
    "CLIENT_ID": "<value>"

There is a method that reads the JSON file during runtime and stores the tokens in variables:

# Get OAuth 2.0 tokens from JSON file 
with open('tokens.json', encoding='utf-8') as tokens_file:
    oauth_tokens_from_json = json.loads(tokens_file.read())

client_token = oauth_tokens_from_json["CLIENT_SECRET"]
client_id = oauth_tokens_from_json["CLIENT_ID"]

I'm quite sure this is not the proper way to do it, and I could not find any specific information for a similar scenario.

  • You can save the hash and salt instead of the plain text values and then use the values passed in for the clientId/secretkey to validate against the encrypted values. – RandomUs1r Dec 18 '18 at 22:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.