Let's say I'm working on an app on a local dev server, localhost:1234 for example. Once I feel ready, I upload any changes to a GitHub repo and have those changes sync with an online website, take exampleapp.com.

Since I'm using authentication in my app, I'm going to need to specify my OAuth domain. My app's not published yet, so I'm fine with changing the domain to localhost so that I can test the auth on my local servers. But when I deploy it to exampleapp.com, however, the auth will fail to work because the settings allow only localhost.

So I made a second, almost identical app. It does a pretty good job of saying, "Please don't authenticate with me unless you know EXACTLY what you're doing!" This would allow me to have my prod version set up for exampleapp.com while the local version is set up for localhost.

Both app client IDs and keys are going to be in public code repositories, and the code will look something like this:

const inDev = (location.host === "localhost:1234");
const clientId = inDev ? 12345 : 23456;
const apiKey = inDev ? "thisIsMyApiKey123" : "tryThisInProdSite789";

Was this the most reasonable decision? Was there something else I could have done instead of creating another app?

  • Is this in the context of using the Stack Exchange API? You don't seem to have any [app] posts here ...
    – Glorfindel
    Dec 2, 2022 at 10:53
  • @Glorfindel 1. Yes. 2. The app is still in dev, and I don't want to post it if putting two client IDs and keys in public code is a security issue or something. That's the question - is it safe/logical to put this in public code? If it isn't, what are the alternatives to doing so that are safe? Dec 2, 2022 at 16:12


You must log in to answer this question.

Browse other questions tagged .