I was trying to make a Flickr userscript that allows users to hover of a thread name, and be shown the last reply without having to open the thread. I thought a good way to do this is by using userscripts, but I found out that in order to get the text of the message, you first need to authenticate the user with the API.

This means that I have to make use of the secret_key, and there's no way to make it private in a userscript.

What can I use that will be lightweight and allow this sort of 'browsing enhancement' that userscripts offer, but with the benefit of allowing me to keep the key secret?


A) Since the user is already logged in (or you can require him to be), you probably don't need to use the API at all. There's probably something you can do with GM_xmlhttpRequest(), or by auto-clicking the appropriate link.

B) Or, make the key a little harder to get by making a browser extension instead of a userscript.

C) Or, you could host an app on your own server, so that the client browser never saw the Flickr API calls at all. But this seems like an insane amount of trouble just to guard an API key (which is often not that big a deal).

  • Thanks for the reply. A) implies web scraping which is discouraged by Flickr guidelines. Could you please tell me how a browser extension can hide the key? – confused00 Jun 23 '15 at 11:47
  • No, (A) is not web scraping. It's more like automated user actions and only occurs when a live user is browsing. It's like an extension of the web page/app, but under your control, not Flickr's. Userscripts are not against any decent site's guidelines. (Or, if they are, they are legally and morally invalid. Imagine "guidelines" that say you must browse only with IE and with Java enabled and read every page entirely, etc.) – Brock Adams Jun 23 '15 at 19:03
  • An extension can't hide the key. It just makes it harder for the casual user to get it, because extension files are usually (or can be) packaged and/or compressed. It's a form of "security by obscurity"; it helps, but only so far. – Brock Adams Jun 23 '15 at 19:06
  • Well, when you say "auto-clicking the appropriate link", do I not need to scrap the page to find that link? GM_xmlhttpRequest() is only making an AJAX request AFAIK, but how can I get the link for the request without the API or web scraping? – confused00 Jun 24 '15 at 13:38
  • How do you get that link manually? Then use standard userscript techniques to do that automatically. You need to provide much more detail for help with the details and we're not going to write the script for you. Almost everything you could need to do has been covered already on Stack Overflow. – Brock Adams Jun 24 '15 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.