[Http, Authorization, Storage?] Searching for the recommended way to store Secrets and tokens in (non mobile) uno app

[DevTKSS]

Hey there,
I did read the http and authorization docs, but there were one/two things left open:

1. When targeting windows or desktop or wasm for example, where and how should the secrets like for a Rest API required secret application key or the token be stored?

On mobile like ios (which i am not targeting) there is this chain thing, but i did not found the equaling for a desktop/windows application.
The appsettings file in my opinion is not the right place for this, because as far as I understand, this is not hided from public.

In vs code i would maybe have used dotnet env vault, but dont know if that is available or recommended for uno app?

2. Is there any Auth-Intercepor available in Uno?

Coming from first question, I got to another one:
The secret/token and some other things needs to be added in the http request and authorization header which has been hard coded in samples like TheCatApi and I would prefer to use dependency Injection for it or something similar to this interceptor useable for exactly this behavior i would like, available in angular: https://angular.dev/guide/http/interceptors#dependency-injection-in-interceptors

3. Can "connected services -> OpenAPI -> Rest" be used to generate e.g. classes & interfaces from .json files in a uno app?

I did watch some videos that are using this, but in uno docs you did never "just" use this build-in tool. Is there a reason for that not using?

4. Where to store things like Username + pw, without using some web services like Azure or aws?

Since my app will be first place for myself, but wanting to do things best from start, I am searching for the best way to store this data so the app can read them and also write other data... Thought went to storage, but seems like there is absolutely no explanation to the usage there beside the add proper entitlements for the ios for example. Could someone explain/add that?

[kazo0]

Hi @DevTKSS, great question! And I apologize for the delay in providing information.

The Auth Extensions handle the storage of the auth tokens as well as automatically injecting HTTP handlers for service calls with the currently stored tokens. This is mentioned in this section of the Auth documentation: https://platform.uno/docs/articles/external/uno.extensions/doc/Learn/Authentication/AuthenticationOverview.html#http-handlers

You can see how this is done using IStorage extensions to securely store the retrieved tokens here

As for the API Key question, the information for how to actually use your API Key as part of the HttpClient can be found here: https://platform.uno/docs/articles/external/uno.extensions/doc/Learn/Http/HowTo-EndpointOptions.html. For demo purposes, the API keys here are loading as app settings. Otherwise, you would need to utilize some sort of key vault service for securely fetching your keys.

[DevTKSS]

That here is what i did mean on the other discussion. The "some service" you telling here is the space that open. E.g. my app at the moment has no aws or similar but i would like to e.g. use dotenv-vault.net or dotenv.net package for that, just missing how that detail will be configured correctly in c# app