Managing the client ID and client secret

ReceiptRoller's OAuth authentication uses a pair of a client ID and a client secret issued per app. The client ID is an identifier that is fine to make public, but the client secret is confidential information equivalent to a password.

How to obtain them

1. Developer portal → App → open the target app
2. The "Credentials" tab
3. The client ID is displayed (copyable)
4. The client secret is shown only at initial issuance. After that, regeneration is required

The difference between the client ID and the secret

Storage rules

• Store in environment variables or a secret management service (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, etc.)
• Do not hard-code it into source (if it slips into git, it's game over when the repository leaks)
• Use separate secrets for production / staging / development
• Grant access permission only to production-environment service accounts
• Do not include it in log / error output

What to do on a leak

1. Developer portal → App → Credentials → "Regenerate secret"
2. Store the new secret securely
3. Update the production environment's environment variables and deploy
4. Choose "invalidate immediately" or "invalidate after 24 hours" for the old secret
5. Check the audit log for any unauthorized use

Operating across multiple environments

We recommend always registering separate apps for production and development. Overloading multiple environments onto a single app carries the risk that a development-time glitch affects production users.

Production app: MyApp Production
  → Client ID: prod_xxx
  → Secret: the production secret management service

Development app: MyApp Dev
  → Client ID: dev_xxx
  → Secret: each developer's own .env

Related guides

• Creating a new app
• Obtaining and refreshing an access token
• Rotating and safely storing secrets
• Back to the developer help index