title: Keep a secret key safe in Python
body: <p>I am aware that these questions has been asked before several times separately, and most of the answers I've found are "Python is not easy to obfuscate, because that's the nature of the language. If you really need obfuscation, use another tool" and "At some point you need a tradeoff" (see <a href="https://stackoverflow.com/a/261645/2891462">How do I protect Python code</a> and <a href="https://stackoverflow.com/a/4419966/2891462">How to keep the OAuth consumer secret safe, and how to react when it's compromised?</a>).</p>
  
  <p>However, I have just made a small Python app which makes use of Twitter's API (and therefore needs OAuth). OAuth requires a Consumer Secret, which is to be kept away from users. The app needs that information, but the user should not be able to access it easily. If that information cannot be protected (and I am using obfuscation and protection as synonyms, because I do not know of any other way), <strong>what is the point of having a OAuth API for Python in the first place?</strong></p>
  
  <p>The question(s) then are:</p>
  
  <ul>
  <li><strong>Would it be possible to hardcode the secret in the app and then
  obfuscate it in an effective manner?</strong></li>
  <li><strong>If not, what would be the best way to use OAuth in Python?</strong> I have thought of "shipping" the encrypted consumer secret along with the app and using a hardcoded key to recover it, but the problem remains the same (how to protect the key); having the consumer secret in a server, and have the application retrieve it at start up (if information is sent unencrypted, it would be even easier for a malicious attacker to just use Wireshark and get the consumer secret from the network traffic than decompiling the bytecode, plus how could I make sure that I am sending that secret to my app and not to a malicious attacker? Any form of authentication I know would require having secret information in the app side, the problem remains the same); a mixture of both (have the server send the encryption key, same problems as before). The basic problem is the same: how can you have something secret if critical information cannot be hidden?</li>
  </ul>
  
  <p>I have also seen comments saying that one should use a C/C++ extension for those critical parts, but I do not know anything about that, so if that were the answer, I'd appreciate some extra information.</p>