How do handle developer keys that are supposed to be non human readable in your app? (example: specific conflict with twitter api and twitter gem)

Question

How do handle developer keys that are supposed to be non human readable in your app?

From twitter's developer page, under My Access Token it says:

"Keep the oauth_token_secret a secret. Along with your OAuth consumer secret, these keys should never be human readable in your applications."

However, the awesome twitter gem ( https://github.com/jnunemaker/twitter ) says to make an initializer with this:

Twitter.configure do |config|
  config.consumer_key = YOUR_CONSUMER_KEY
  config.consumer_secret = YOUR_CONSUMER_SECRET
  config.oauth_token = YOUR_OAUTH_TOKEN
  config.oauth_token_secret = YOUR_OAUTH_TOKEN_SECRET
 end

What do you do about this type of conflict? You can't just reset the oauth_token and oauth_token_secret, as far as I know you have to create a whole new twitter app. I concerned as I am going to begin working with some freelancer programmers and to begin with I wouldn't want to trust them my apps private keys/tokens. Thanks.

Answer 1

It's not a problem if your trust your developers. The security implication of a "leaked" token are not catastrophic (basically, someone could write an application that "looks like" your application from Twitter's point of view). You could request a reset of your OAuth keys, I don't know what Twitter's specific requirements are on that front, though.

But if you don't trust your developers (and that's a bit of a worry to begin with, IMO) then you could make the keys configurable and then set up two Twitter applications: a "test" or "dev" app and your "production" app. Give your "untrusted" developers the "dev" keys and reserve the "production" keys for yourself only.