How to keep API secret securely in Frappe?

Danwand_N_S · May 14, 2023, 4:32am

I am developing a Frappe application, I am using a token to call API requests, I have currently hard-coded the API token in the code, This is probably a bad practice, What is the best practice to keep the API token in Frappe securely ?

Thanks in advance

snv · May 14, 2023, 5:12am

Hello,

If you have other settings that you’d like to manage for this API together with the API secret, I’d recommend that you create a single settings doctype. Within this, you can create a password field to store your API Secret. For example:

github.com

frappe/frappe/blob/4bd32bcf04c9bb7ab92fd8fa82d9399c2e4b7c10/frappe/integrations/doctype/google_settings/google_settings.json#L34


      
          {
           "description": "The Client ID obtained from the Google Cloud Console under <a href=\"https://console.cloud.google.com/apis/credentials\">\n\"APIs &amp; Services\" &gt; \"Credentials\"\n</a>",
           "fieldname": "client_id",
           "fieldtype": "Data",
           "in_list_view": 1,
           "label": "Client ID",
           "mandatory_depends_on": "google_drive_picker_enabled"
          },
          {
           "fieldname": "client_secret",
           "fieldtype": "Password",
           "in_list_view": 1,
           "label": "Client Secret"
          },
          {
           "description": "The browser API key obtained from the Google Cloud Console under <a href=\"https://console.cloud.google.com/apis/credentials\">\n\"APIs &amp; Services\" &gt; \"Credentials\"\n</a>",
           "fieldname": "api_key",
           "fieldtype": "Data",
           "label": "API Key",
           "mandatory_depends_on": "google_drive_picker_enabled"
          },

You can then access the password field using doc.get_password, like so:

github.com

frappe/frappe/blob/eb8da5fd59c9b60a1cc78eae8aa0eb89e8c7f7ce/frappe/integrations/google_oauth.py#L67


      
          
          
	def authorize(self, oauth_code: str) -> dict[str, str | int]:
          		"""Returns a dict with access and refresh token.
          
          
		:param oauth_code: code got back from google upon successful auhtorization
          		"""
          
          
		data = {
          			"code": oauth_code,
          			"client_id": self.google_settings.client_id,
          			"client_secret": self.google_settings.get_password(
          				fieldname="client_secret", raise_exception=False
          			),
          			"grant_type": "authorization_code",
          			"scope": self.scopes,
          			"redirect_uri": get_request_site_address(True) + CALLBACK_METHOD,
          		}
          
          
		return handle_response(
          			post(self.OAUTH_URL, data=data).json(),
          			"Google Oauth Authorization Error",

Another option is to store it in the site_config.json and access it using frappe.conf.site_config_key.