topic Application key - shareable? in Archived content

Application key - shareable?

catharsis — Mon, 08 Apr 2013 12:40:02 GMT

Hi,

Is the developer application key (for libspotify) supposed to be private? I.e., am I supposed to not share my key with anyone else?

If so, how are others supposed to use my application? If not, how does Spotify prevent misuse of my app key?

Re: Application key - shareable?

Peter__ — Mon, 08 Apr 2013 13:35:04 GMT

Hey 🙂

Usage of Application Keys is covered in part 2 of the libspotify terms of usage.

Peter

Re: Application key - shareable?

catharsis — Mon, 08 Apr 2013 13:52:57 GMT

Hi Peter,

thanks for the quick reply! That answers my question. However, I'm still a bit uncertain as to what Spotify determines a "secure manner" of embedding the application key. As far as I can tell, libspotify doesn't accept an encrypted key. In other words (unless I'm wrong and the encryption part has simply been left out of the docs) it has to be embedded as-is. Of course, this would make it pretty easy for a third party to gain access to the key using, for example, gdb.

Does Spotify offer any recommendations on this? Any idea how other libspotify apps deal with this?

Thanks in advance,

Anton

Re: Application key - shareable?

Peter__ — Mon, 08 Apr 2013 14:39:49 GMT

I don't work for Spotify so I don't have any additional information I can give you, however from reading the terms I would guess that the key needs to be stored in the program code rather than being read in from a human readable file or something like that. It also means that you can't open-source your application since the key would then be public.

I am unsure if gdb would allow you to view the key if it was stored in the code and then distributed as a compiled executable?

Peter

Re: Application key - shareable?

catharsis — Mon, 08 Apr 2013 14:53:28 GMT

I see, would you know of a better place where I might ask this question instead? I'm very excited about the libspotify project, and applaude Spotify for the effort. However, I don't want to risk any liabilities by allowing others to use my application. I suppose a work-around would be to require all users to have their own app key, but the way I've understood it, that kind of defeats the purpose of the appkey (or at least one of them - the traceability).

To answer your question: yes, gdb (and any other debugger worth its salt) absolutely lets you see the key, as well as any other data. In the simple case (where you know the symbol name) it's as easy as:

gdb ./my-libspotify-app

(gdb) print /x g_appkey

< KEY HERE >

Thank you for your help, much appreciated!

Anton

Re: Application key - shareable?

Peter__ — Mon, 08 Apr 2013 14:55:27 GMT

Yeah, I know what you mean I am considering starting a little raspberry pi summer project this year!

There are some places you can get support here.

Peter