#jaime-alonso-nonicaio_api
radiant remnantBOT
đ Welcome to your new thread!
â˛ď¸ We'll be here soon! Typically we respond in a few minutes, but sometimes we might take a bit longer if the server is busy or if you have a particularly tricky question.
âąď¸ We close idle threads, which makes them read-only. Once a thread is closed it won't be reopened, but you can always start a new thread if you have another question.
đ This thread will always be available, even after it's closed. You can find it again using Discord's search, or you can save this link: https://discord.com/channels/841573134531821608/1306955993875349584
đ Have more to share? Add more details, code, screenshots, videos, etc. below.
queen lichen
hi there!
I'm concerned that my app can be reverse engineered and my API key extracted
what do you mean by this? your secret API key should only be stored securely on your backend server, so that nobody can access it
rustic pollen
that somebody opens the folder of my program in their pc
look for the dll
and get the code behind the dll
and extract the API key
queen lichen
that doesn't make any sense. the secret API key shouldn't be in a folder users can open. it should be only stored in your backend server. otherwise this is a big security risk.
queen lichen
you have to use a backend server to store the secret key
like you said, users can access the code of your desktop app, so don't store any sensitive information there.
rustic pollen
but if i store it in a server
they can also extract the information to access the server
queen lichen
or find a way to move your payment flow on a website, and not in your app.
they can also extract the information to access the server
I don't get it. only you can access your own server.
queen lichen
no idea what that means. can you be more precise in what exactly you are trying to do? what is a "session"? who is "their customer"?
rustic pollen
ok
I have a desktop app
that users install with an exe file
in their computers
the app has different features
and clients can buy those
to enable/disable apps I use Stripe customer metadata
to see which features were bought
everything is developed in c#
and Stripe API methods run in user computer
(with the app)
any question?
*to enable/disable featuresI use Stripe customer metadata
queen lichen
and Stripe API methods run in user computer
you can't do that, as mentioned previously, because it's a huge security risk.
instead, your app can call your backend server, and your backend server makes calls to the Stripe API, and then return the relevant information to your app.
this way no one can access your secret API key.
queen lichen
what do you mean?
rustic pollen
ok