I would like to release the code for an application I made in Python to the public, just as a pastebin link. However, the app needs a client ID, secret and user agent to access the API (for reddit in this case).
How can I store the key strings in the python code without giving everyone free reign on my api access? Maybe a hashing function or similar?
You probably don't want to provide the actual keys and other private information at all, hashed or otherwise. Besides being a security issue, it probably violates all sorts of agreements you implicitly made with the provider.
Anyone using the application should be able to get their own key in the same manner you did. You can (and should) provide instructions for how to do this.
Your application should expect the key information in a well documented format, usually a configuration file, that the user must provide once they have obtained the keys in question. You should document the exact format you expect to read the key in as well.
Your documentation could also include a dummy file with empty or obvious placeholder values for the user to fill in. It may be overkill, but I would recommend making sure that any placeholders you use are guaranteed not to be valid keys. This will go a long way to avoiding any accidents with the agreements you could violate otherwise.
