Best practice for checking in api credentials used in Angular 2+

user_6443565 0
Viewed 383

I have an app using google oauth for authentication.I have stored by google client id and secret in environment.ts of my Angular app. If I have to publish my code in GitHub, I dont want that info to be published and made public.Also,I dont want to add environment.ts on my .gitignore.

What are some accepted approaches in storing and checking in private credentials in GitHub for Angular projects? Is my approach to store my google client id and secret key in environment.ts a good solution?

UPDATES : ( list of suggestions im looking into )

  • Create a local dev branch containing the credential and the master branch is for GitHub checkins.
angular google-oauth github
1 Answers

The problem here will be that even if you don't check in your credentials into GitHub once built and publicly available the credentials will still be easily readable in your source. If this is really an issue (which it is!) your best bet would be to use an API intermediary that receives the callback from the Google API and returns the outcome back to your application.

This approach opens up many opportunities to authorize further communication with your API using Javascript Web Tokens.

user_23852480
Related