Show HN: Npm donate

#1

Post by bukinoshita » Mon, Jul 17, 2017, 5:17 PM UTC

Re: Show HN: Npm donate

#2

Post by detaro » Mon, Jul 17, 2017, 5:21 PM UTC

The documentation you link for the stripe API key says

Authenticate your account when using the API by including your secret API key in the request. You can manage your API keys in the Dashboard. Your API keys carry many privileges, so be sure to keep them secret! Do not share your secret API keys in publicly accessible areas such GitHub, client-side code, and so forth.

How is this supposed to work safely, when you need to put the key in the package? Or is the enduser (who wants to donate) somehow expected to have their own API key?

Re: Show HN: Npm donate

#3

Post by bukinoshita » Mon, Jul 17, 2017, 5:47 PM UTC

detaro wrote: post #2

The documentation you link for the stripe API key says Authenticate your account when using the API by including your secret API key in the request. You can manage your API keys in the Dashboard. Your API keys carry many privileges, so be sure to keep them secret! Do not share your secret API keys in publicly accessible areas such GitHub, client-side code, and so forth. How is this supposed to work safely, when you n…

You can check an example here where I use `dotenv`.

https://github.com/bukinoshita/npm-donate/blob/master/exampl...

Re: Show HN: Npm donate

#4

Post by detaro » Mon, Jul 17, 2017, 6:06 PM UTC

bukinoshita wrote: post #3

detaro wrote: post #2

The documentation you link for the stripe API key says Authenticate your account when using the API by including your secret API key in the request. You can manage your API keys in the Dashboard. Your API keys carry many privileges, so be sure to keep them secret! Do not share your secret API keys in publicly accessible areas such GitHub, client-side code, and so forth. How is this supposed to work safely, when you n…

You can check an example here where I use `dotenv`. https://github.com/bukinoshita/npm-donate/blob/master/exampl...

So the latter? People need to have a stripe API key to use it to donate?

Re: Show HN: Npm donate

#5

Post by bukinoshita » Mon, Jul 17, 2017, 6:09 PM UTC

detaro wrote: post #4

bukinoshita wrote: post #3

Earlier quoted context omitted.

You can check an example here where I use `dotenv`. https://github.com/bukinoshita/npm-donate/blob/master/exampl...

So the latter? People need to have a stripe API key to use it to donate?

Just the project owner.

1. Project maintainer add `npm-donate`; 2. Creates stripe account; 3. Add API Key; 4. Release;

Users that wants to donate to the project, doesn't need an API key.

Re: Show HN: Npm donate

#6

Post by detaro » Mon, Jul 17, 2017, 6:10 PM UTC

bukinoshita wrote: post #5

detaro wrote: post #4

Earlier quoted context omitted.

So the latter? People need to have a stripe API key to use it to donate?

Just the project owner. 1. Project maintainer add `npm-donate`; 2. Creates stripe account; 3. Add API Key; 4. Release; Users that wants to donate to the project, doesn't need an API key.

Add API key where? I don't get how this authenticates to Stripe without distributing the API key.

Re: Show HN: Npm donate

#7

Post by bukinoshita » Mon, Jul 17, 2017, 6:15 PM UTC

detaro wrote: post #6

bukinoshita wrote: post #5

Earlier quoted context omitted.

Just the project owner. 1. Project maintainer add `npm-donate`; 2. Creates stripe account; 3. Add API Key; 4. Release; Users that wants to donate to the project, doesn't need an API key.

Add API key where ? I don't get how this authenticates to Stripe without distributing the API key.

To the file where is calling `npm-donate`. But instead of hard code the API Key, you use some sort of dotenv to hide the API key from the end users.

When users install your package, they won't see your API key.

Re: Show HN: Npm donate

#8

Post by detaro » Mon, Jul 17, 2017, 6:18 PM UTC

bukinoshita wrote: post #7

detaro wrote: post #6

Earlier quoted context omitted.

Add API key where ? I don't get how this authenticates to Stripe without distributing the API key.

To the file where is calling `npm-donate`. But instead of hard code the API Key, you use some sort of dotenv to hide the API key from the end users. When users install your package, they won't see your API key.

The code on the endusers machine needs the API key to function, since there is no server on the publishers side involved, right? So you have to give the API key to them in some way, if directly embedded in the code or not.

Re: Show HN: Npm donate

#9

Post by bukinoshita » Mon, Jul 17, 2017, 7:30 PM UTC

detaro wrote: post #8

bukinoshita wrote: post #7

Earlier quoted context omitted.

To the file where is calling `npm-donate`. But instead of hard code the API Key, you use some sort of dotenv to hide the API key from the end users. When users install your package, they won't see your API key.

The code on the endusers machine needs the API key to function, since there is no server on the publishers side involved, right? So you have to give the API key to them in some way , if directly embedded in the code or not.

You are right. I will add a warning and try to figure it out a better way. Thanks!

Re: Show HN: Npm donate

#10

Post by bukinoshita » Tue, Jul 18, 2017, 10:52 PM UTC

bukinoshita wrote: post #9

detaro wrote: post #8

Earlier quoted context omitted.

The code on the endusers machine needs the API key to function, since there is no server on the publishers side involved, right? So you have to give the API key to them in some way , if directly embedded in the code or not.

You are right. I will add a warning and try to figure it out a better way. Thanks!

fixed! released v0.0.2