I've developed a little Python Dropbox app but I have no I idea how to hide the app key and app secret. Until I solve this problem I'm not sure how I can ship my app as this seems to be a significant security threat.
I know it is hard to obfuscate code, most especially Python so I'm not really sure that that is an option.. but what else could I do? I thought about using some form of encryption and/or storing them on a server to be retrieved when the app starts. Is it possible to write the part that deals with the keys in another language that's more easily to obfuscate like C? As I don't know much about encryption, I'm not sure if any of these options are feasible or not.
To prevent casual misuse of your app secret (like someone who copy/pastes code not realizing they're supposed to create their own app key/secret pair), it's probably worth doing a little obfuscation, but as you point out, that won't prevent a determined individual from obtaining the app secret.
In a client-side app (like a mobile or desktop app), there's really nothing you can do to keep your OAuth app secret truly secret. That said, the consensus seems to be that this doesn't really matter. In fact, in OAuth 2, the recommended flow for client-side apps is the "token" or "implicit" flow, which doesn't use the app secret at all.
Python Dropbox app, what should I do about app key and app secret?