# Storing Tokens and Credentials

Keeping tokens and credentials secure is important when developing your applications and distributing those applications to the world.

# Client ID and Client Secret

These two pieces of information is provided when you register your application with Luxstay.

1. The Client ID is used to identify your application and usually appears in OAuth authorization URLs. The Client ID and be shared publicly in code and other contexts because this value alone cannot be used to act on your application's behalf.

2. Your Client Secret, on the other hand, should be kept privately and securely. It is used to identify your application's rights when exchanging tokens with Luxstay. You should not distribute the Client Secret via code, email, or any other public channels.

# Rotating And Expiring Tokens

Access tokens are usually short-lived (short TTL), they should be expired frequently and re-obtained using refresh token. We provided the endpoint for refreshing access tokens.

# Redirect URIs

Redirect URIs appear as URLs and usually used in some authorization grant like Authorization Code. They are safe to be part of published code. However, you should ensure that the redirect URIs defined in you applications are limited to domains you have direct control.

# Token Storage

Token storing is hard, and it depends on the context, usage and design requirements.

• If you do not need a token to make your functionality works, you should not store more user secrets than you need to.
• Make sure to request the least-privilege token (the token with the least number of necessary scopes) to protect your users in case of security breach.

Other security advice to consider:

• Use a database to store tokens, do not store them in your code.
• Don't use tokens via the query string of a URL, use HTTP header when transmitting secrets.
• Apply rate-limiting to prevent misuse of tokens or token spamming.
• Implement XSS, CSRF, SQLi protection methods.
• Use SSL/TLS.
• Do not log your tokens or move them outside of your application's database.
• Use two-factor authentication.