Ways to store Client ID and Secret securely for automated executions in Google Scripts

Question

I'm writing a Google Script that will call an external API and pull the resulting data into a Google Sheet. The API requires a Client ID and Secret value for authorization, and I need to keep those values secure. I would also like to trigger the script to run periodically (basically, I'm trying to automate the updating of this sheet as much as possible).

I'm no data security expert, but keeping the Client ID and Secret hardcoded seems like a terrible idea. Most of the search results I've found recommend using the Properties Service to store those values, but in order to set those properties I'd have to hardcode them in the same script, correct? If so, that doesn't solve the security problem.

Other recommendations involve prompting the user to enter the credentials to authorize each run of the script. This solves the security requirement, but I want this process to be as automatic as possible. If I'm opening the script and providing my credentials each time it runs, then I may as well skip the triggered executions.

Are there any other solutions? For context, I am the only person who needs to access this script and no one else should be able to access the Client ID and Secret.

Answer 1

Since you are the only one who has access to the script (having View access to the spreadsheet doesn't allow users to look at the bound script), hardcoding the Client ID and Secret shouldn't be a problem. Just don't give them Edit access to the spreadsheet.

If you don't want to hard-code the data directly anyway, you have some alternatives:

Using Properties Service:

Use Properties Service , as you mentioned. You could, for example, set the Client ID by running this once (in the legacy IDE, you can set these properties manually too):

function setClientId() {
  var props = PropertiesService.getScriptProperties();
  props.setProperty('Client ID', '{YOUR_CLIENT_ID}');
}

Once the property was set, you can remove '{YOUR_CLIENT_ID}', or even the whole function, if you don't want to keep it hard-coded. The script could then retrieve the stored property the following way:

function getClientId() {
  var props = PropertiesService.getScriptProperties();
  return props.getProperty('Client ID');
}

Using library:

Another option could be to store this information in a different script, to be used as a library (see Gain access to a library ):

var CLIENT_ID = "YOUR_CLIENT_ID";
var SECRET = "YOUR_SECRET";

And then import this library in your main script (see Add a library to your script project ). In the sample below LIBRARY is the library Identifier name:

Code.gs (from main script):

function getData() {
  const clientId = LIBRARY.CLIENT_ID;
  const secret = LIBRARY.SECRET;
  // ...
}

Note:

Please note that, even if you don't hard-code your data directly, anyone who can execute your script can potentially retrieve this data. For example, they could log what's returned by getClientId() .

If the script has access to some data, users who can execute the script can access this data too.