Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do handle developer keys that are supposed to be non human readable in your app?

From twitter's developer page, under My Access Token it says:

"Keep the oauth_token_secret a secret. Along with your OAuth consumer secret, these keys should never be human readable in your applications."

However, the awesome twitter gem ( ) says to make an initializer with this:

Twitter.configure do |config|
  config.consumer_key = YOUR_CONSUMER_KEY
  config.consumer_secret = YOUR_CONSUMER_SECRET
  config.oauth_token = YOUR_OAUTH_TOKEN
  config.oauth_token_secret = YOUR_OAUTH_TOKEN_SECRET

What do you do about this type of conflict? You can't just reset the oauth_token and oauth_token_secret, as far as I know you have to create a whole new twitter app. I concerned as I am going to begin working with some freelancer programmers and to begin with I wouldn't want to trust them my apps private keys/tokens. Thanks.

share|improve this question
up vote 0 down vote accepted

It's not a problem if your trust your developers. The security implication of a "leaked" token are not catastrophic (basically, someone could write an application that "looks like" your application from Twitter's point of view). You could request a reset of your OAuth keys, I don't know what Twitter's specific requirements are on that front, though.

But if you don't trust your developers (and that's a bit of a worry to begin with, IMO) then you could make the keys configurable and then set up two Twitter applications: a "test" or "dev" app and your "production" app. Give your "untrusted" developers the "dev" keys and reserve the "production" keys for yourself only.

share|improve this answer
Thanks for the help. The reason I don't trust my developers yet is because I'm looking to try some freelancers out from odesk. Without having a real recommendation or connection it's hard to trust at first. How does it work to make your keys configurable? I think this is what I need to do. – trying_hal9000 Apr 14 '11 at 23:54
I don't know much about RoR personally, but this looks like a fairly standard way of doing it. – Dean Harding Apr 15 '11 at 0:25
Great link! Thank you very much for posting that. You wouldn't by chance know if your supposed to include config.yml in your .gitignore file so that its stay private??? Otherwise I'm still confused how the variables stay out of the code. Thanks again. – trying_hal9000 Apr 15 '11 at 0:54
@trying_hal9000: That's probably what I'd do, yeah. – Dean Harding Apr 15 '11 at 1:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.