Purpose: To find a way to securely store google/facebook client id and secret in backend web server. I read that, I should not store client id and secret in web server.

Recommendation needed: What software or practice I can use to store client id and secret key for my web applications.

Addtional information: I have built a MERN application that authenticate user by google login and facebook login. In my code, backend server communicate with google and facebook authentication.


On a hosting platform which is not shared you probably have very few choices other than storing it on the server. However, it is normally best practice to store credentials in a separate file from your code (eg. a .env file).

When storing credentials in a Git (or other version control) repository these should not be in plain text.

For this I would recommend using Ansible, and Ansible Vault and combining it with you deployment.

If you are after a quick solution, you could always GPG encrypt your credentials and have them in a repository. A good guide for instructions on how to do this: https://www.cyberciti.biz/tips/linux-how-to-encrypt-and-decrypt-files-with-a-password.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.