MYOB API Keys with OAUTH 2.0

Hi luke_dc,

Hopefully another developer in the community can get you a response soon, otherwise feel free to reach out to the support team via developer.myob.com.

Regards,

Sai 

Thanks Sai, I've submitted a request to the API support team.

Hi luke_dc​ 

I would be very careful about using any advise from ChatGPT - it is banned in our business. However,  OAUTH PKCE = Proof key for code exchange isn't available in MYOB API but is available in XERO API and is a means to get around this problem.

However, to solve your problem - yes, handing out your secret in plain text or a token that has a long life is handing keys to the kingdom in your app.

The bottom line is you need to encrypt these, somehow and there are a lot of articles on how to do this - but do not embed your secret into your source code - that is bad ju ju development - you need to encrypt and store it in a secret location on the user's computer - in registry or in a hidden location - so that if your app is stolen the key doesn't go with it.

And yes, there are ways of doing this without compromising your secret key and tokens - but the bottom line is do not store in plain text. 

And finally- obfuscate your source code - there are utilities to do this on the internet.

The Doc.

Hi luke_dc​ 

Have a look at a very good series of articles on this very issue at

https://hackernoon.com/mobile-app-security-techniques-682a5da4fe10

However, a very good way, though not fool proof is to embed it in your code but break it into bits but the other way which was quite clever was a hidden directory with json files encrypted. Not fool proof but hard to detect.

The Doc