--Apple-Mail-96F9B27F-7DAC-444D-9A9E-D2F3FC076CE7 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > El 18 ene. 2021, a la(s) 08:22, Jean-Baptiste Mardelle e= scribi=C3=B3: >=20 > =EF=BB=BFHi all, >=20 > For Kdenlive, we are planning to expand the use of online services to down= load=20 > ambiance music or videos for use in personal projects. To this purpose, mo= st=20 > online services provide us an API key that is used to identify our app=20 > (Kdenlive) when querying their API. >=20 > Does anyone have experience / advice on how to protect these API keys so t= hat=20 > they are not publicly available ? Is there any KDE online service or frame= work=20 > helping to achieve that ? >=20 > Thanks in advance for your help, >=20 > Jean-Baptiste Mardelle Protecting an API key on a locally-running application is impossible even fo= r a closed source app. It's equivalent to the impossible task DRM intends to= achieve (hiding the content decryption key from the user while decrypting c= ontent on their computer). If you give the application to the user, as oppos= ed to running everything in a server, the key *will* be publicly available. https://invent.kde.org/pim/kdepim-runtime/-/blob/master/resources/imap/gmail= passwordrequester.cpp#0016 --=20 Nicolas= --Apple-Mail-96F9B27F-7DAC-444D-9A9E-D2F3FC076CE7 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

El 18 ene. 2021, a la(s) 08:22, Jean-Baptiste Mar= delle <jb@kdenlive.org> escribi=C3=B3:

=EF=BB=BFHi all,

For Kdenlive, we are planning to expand the use of online s= ervices to download
ambiance music or videos for use in per= sonal projects. To this purpose, most
online services provi= de us an API key that is used to identify our app
(Kdenlive= ) when querying their API.

Does anyone have= experience / advice on how to protect these API keys so that
they are not publicly available ? Is there any KDE online service or fram= ework
helping to achieve that ?

= Thanks in advance for your help,

Jean= -Baptiste Mardelle

Protecting an API k= ey on a locally-running application is impossible even for a closed source a= pp. It's equivalent to the impossible task DRM intends to achieve (hiding th= e content decryption key from the user while decrypting content on their com= puter). If you give the application to the user, as opposed to running every= thing in a server, the key *will* be publicly available.

https://invent.kde.org/pim/kdep= im-runtime/-/blob/master/resources/imap/gmailpasswordrequester.cpp#0016<= /div>

Nicolas

= --Apple-Mail-96F9B27F-7DAC-444D-9A9E-D2F3FC076CE7--