Secure deployment of client secrets in python
<p>I'm planning to write a <code>Kodi (former XBMC)</code> plugin for <code>Spotify</code> using <code>Python</code>. Some time ago, Spotify deprecated their old library <code>libspotify</code> and introduced a new <code>ReST</code> based <code>WebAPI</code>. I would like to use this api to request data like the playlists, followed albums and other user specific stuff from Spotify. This <code>WebAPI</code> uses the <code>OAUTH</code> mechanism to authorize an application to use user-specific data.
Thus, I require a <code>Client ID</code> and a <code>Client Secret</code>. While the <code>Client ID</code> is public I have not problem in storing it in the sourcecode. But what about the <code>Client Secret</code>? This secret is required by the application to authenticate itself at spotify. Thus, it needs to be deployed as well.</p>

<p><strong>How do I securly deploy this secret, such that a user of the plugin is not able to read out the secret?</strong></p>

<p>I can't use obfuscation techniques because python is interpreted and a user can simply start an interpreter, import my modules and read out the reconstructed secret. The same holds for encrypting the key. The application needs to be able to decrypt the secret and because of this, I would need to deploy the encryption key as well. This is a chicken or egg problem. </p>

<p>Any suggestions about this? How does other software solve this problem?</p>

<p>EDIT: I just found this <a href="https://tools.ietf.org/html/rfc6819#page-16" rel="nofollow">RFC6819</a>. Seems like this is a general problem in <code>oauth</code>. </p>

<p>In this case, you can use the <a href="https://developer.spotify.com/web-api/authorization-guide/#implicit_grant_flow" rel="nofollow">Implicit Grant Flow</a>, which is designed for client-side applications where storing the secret is impractical for security reasons.</p>

python rest security oauth spotify