Aaron Parecki

that solves a completely different problem (and creates new problems), but isn't related to the challenge of how to avoid embedding secrets

you'd be surprised how much of web security is not immediately obvious to people

I just wrote this up since I couldn't find a good answer online! https://developer.okta.com/blog/2019/01/22/oauth-api-keys-arent-safe-in-mobile-apps

Hope it helps!

Even though my site uses webmention.io as its endpoint, I use the web hooks to push all the responses to my site where it stores its own copy of them.

Neither. The dashboard only shows the latest few, but that's just me being lazy and not giving you a UI to page through older ones. It stores them all forever, and I have no plans to delete old ones there.

But you're right that you should copy that data to your own site somehow!