Question

I’m developing a WinRT application that makes use of the Google Tasks API. Currently, the ClientSecret and ClientID strings are embedded in the code. However, I’ve read that this should be avoided, as Windows 8 Apps can be easily reverse engineered.

So, what is a better way to keep these tokens secure?

Thanks in advance.

Answer 1

From Google documentation, in the “Installed application” section:

The client_id and client_secret obtained during registration are embedded in the source code of your application. In this context, the client_secret is obviously not treated as a secret.

Read more here: https://developers.google.com/accounts/docs/OAuth2InstalledApp