I am doing a research on an app which has some secret ID. I see that the source code of the app has the secret ID hardcoded inside and the API to request for the access token has just this Secret ID as its query parameter. So ideally it is possible to call this API from literally anywhere (I tried even with Postman). And I was successful to get the access token - it was valid for 2 hours. I can regenerate it as many times as I want since I have the Secret ID with me.

So they had a public documentation of their APIs in which they have mentioned that Secret ID is not to be stored anywhere in the dev environment as plain text for security purposes (However the developers themselves did not follow it). And there were a lot of other APIs requests which required only for this access token as its query string parameters - but most of them seem not so critical information (or at least I feel so). One of them was how many users visited their app, how many new and how many retained, etc.

I would like to report the vendor app about these but I would need a valid proof of concept to exploit this. There is also a chance where they might ignore my report saying that there are no critical information that can be fetched/modified using this leaking access token (which contradicts with their documentation, but still)

So in general, I am confused about this. Should access tokens and the app secret always remain a secret only no matter what or does it depend on the information that can be obtained using these secrets? To which should more priority be given?

  • The impact of a design fault does indeed depend on the sensitivity of the data.
    – schroeder
    Commented Nov 11, 2022 at 8:59
  • Related: security.stackexchange.com/questions/183547/…
    – schroeder
    Commented Nov 11, 2022 at 9:00
  • 1
    Not all API keys are secret or need to be. What's confusing me is that the documentation is saying that it should be treated as a secret but they themselves do not. It could be a documentation error or secrets mishandling. It's worth flagging it to them, but perhaps as a question and not a verified security flaw.
    – schroeder
    Commented Nov 11, 2022 at 9:02
  • @schroeder I totally agree to your point. But what surprises me is that there is a lot of data that can be gained using this secret. And yet they hardcode it.
    – Supraja
    Commented Nov 11, 2022 at 20:00
  • Leaking the access token is probably nowhere near as problematic than leaking the API secret. In particular -- the access token expires in only two hours and may be bound to a single client address or even to a single session. After all, if a legitimate application roams to a new IP address, it can just generate a new access token.
    – Ben Voigt
    Commented Nov 11, 2022 at 22:35

1 Answer 1


Should access tokens and the app secret always remain a secret

Should some impossible thing happen?

It's impossible to do that, apps are relatively easy to compromise. APIs should be designed under the assumption that a malicious user has access to their token and secrets.

Design your API to compartmentalise your data so that such a user cannot fetch or alter data that they do not own.

  • So this is a client side part of the code and I do not have access to the server side. But it is clear in their document that the secret has to be stored on the server side and some of the apis have to called on the server side only. But the developers are indeed doing the exact opposite of this and hence this raises the question to me.
    – Supraja
    Commented Nov 12, 2022 at 1:54
  • My main concern is now is not the exposing of secrets or the access tokens by the developer's mistake (maybe?) but around the information that can be fetched using these access tokens. I checked their API documentation and most of them are just wanting this access tokens to return their user info, their analytics info, etc (most of these are GET APIs and very few POST). So how valuable and sensitive are these information is what I am concerned because even if these are leaked/exposed there should be no significant data leaking
    – Supraja
    Commented Nov 12, 2022 at 1:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .