title: Where should I store a client_secret key in Django?
body: <p>I have built an <code>Android</code> app with a <code>Django REST</code> backend, using <code>django-rest-social-auth</code> (Oauth2). Everything works fine but I am wondering where/how should I store the <code>client_secret</code> (of the OAuth Django app created in /admin) key, used for the first call to convert my <code>user_token</code> (or username/password if logged by credentials) to an <code>access_token</code> that will be used in all the next calls.</p>
  
  <p>Indeed, I have read that it cannot be stored within my Android app as it can be decompiled. Thus, I store it on my server and retrieve the right <code>client_secret</code> according to the incoming <code>client_id</code>. But I do not know if it is the classical way to handle it.</p>