I was writing a bash script for Gmail that would authorize itself using OAuth2, and make API calls using the received tokens. It worked.
But now I'm stuck on thinking how to securely store the Client ID and Client Secret in my script, which is open to all on GitHub. Since leaking one's own Client Secret and Client ID isn't a good idea, as someone else will be easily able to disguise their apps with one's own. How do I proceed with this issue?
Here's the issue in short:
- My program critically needs Client ID and Client Secret to work.
- My program is open source and hence I can't include them directly in the code.
- I want all the users who download my program to be able to work with my own set of Client ID and Client Secret, without them actually knowing what the Client ID and Client Secret are!
Basically, I need to think of a way that would transfer some secret data, either through or bypassing GitHub, from my end to the user's PC such that only the program(my script) must be able to read it, not the user!
I know this seems impossible, but I posted this question to verify if it's possible or not. If possible, then I'd like to know how.