Question

The instructions on the JanRain installation page says to load the app id dynamically. Could someone explain what that means? This is Javascript, so the appid has to go the client, correct? Thanks.

http://documentation.janrain.com/engage/widgets/sign-in

Answer 1

Yes – as the documentation states, you need to provide your AppID (provided on the home page of your Janrain account). Depending on what your choice of server-side markup is, you can provide the AppID as a server side markup sequence referring to a configuration source, or something similar.

This is a suggestion made so that if you need to change this key at some point (perhaps the application gets compromised and you need to change your app and secret keys, you change your application name) there’s a single location in some configuration file to change instead of throughout all your web pages.

Without any further knowledge of what your server side technology is, I can’t be more specific about how to implement the “app ID dynamically (through configuration)”.

If you’re confused about having multiple keys, think of it in the way of public/private key authentication. The App ID is your public key; with which you communicate to their the servers publically to say who you are (along with the URL used in the RPX widget, which also identifies you and your application).

When you receive your callback through the token url provided to them, you make the call back to them server side and use the private key there (as well as communicating via SSL), to complete the authentication.