Server-side authentication
A server-rendered application needs Kinde login configuration.
Kinde · Pipe
KINDE_CLIENT_SECRET
KINDE_CLIENT_SECRET stores the confidential secret issued for a Kinde application. Configure it in environment settings for back-end or M2M authentication, and keep it out of source control and client-side code.
How it works
KINDE_CLIENT_SECRET is the secret key issued for a Kinde application. Store it in environment configuration and provide it to the server-side SDK or authentication client rather than exposing it in browser code.
Syntax
KINDE_CLIENT_SECRET=<your_kinde_client_secret>Parameters
| Name | Type | Description |
|---|---|---|
KINDE_CLIENT_SECRET | string | The confidential client secret issued for the Kinde application; supplied through environment configuration. |
Returns
An environment variable containing the Kinde application client secret; it is consumed by server-side authentication code.
Key points
- Retrieve the value from the Kinde application's Application details page.
- The environment variable declaration uses KINDE_CLIENT_SECRET as the key and the issued secret as its value.
- Use this credential with back-end or machine-to-machine Kinde applications.
Common mistakes
- Use the client secret only for back-end and machine-to-machine applications; do not expose it to browser code.
- Exclude the environment file containing the secret from source control, typically through .gitignore.
Example: Configure the client secret
KINDE_CLIENT_SECRET=<your_kinde_client_secret>Set the secret in a local environment file, then read it only from server-side application configuration.
When to use it
Machine-to-machine authentication
A service requests Kinde tokens without user redirection.
Secure environment-based configuration
A deployment pipeline supplies credentials without embedding them in the repository.
Interview questions
QWhat is KINDE_CLIENT_SECRET and where do you obtain it?
KINDE_CLIENT_SECRET is the secret credential for a Kinde application. The documentation says to obtain it from the application's Details page and place it in environment configuration for server-side use.
Follow-up: How should it be handled in production? Inject it through secure environment configuration or a secret store, and keep it out of source control and client-side bundles.
QHow is KINDE_CLIENT_SECRET configured?
Add KINDE_CLIENT_SECRET to the environment file used by the application, alongside the other Kinde app values. The value comes from the application's Details page.
Follow-up: Why not hard-code it? Hard-coding increases the chance of accidental disclosure and makes rotation harder; environment or secret-manager configuration avoids both problems.
QWhere must the client secret be used?
It is intended for back-end and M2M applications, not public browser code. A server-side SDK can read it from environment configuration when authenticating with Kinde.
Follow-up: What is the related M2M concern? Production M2M token requests should run server-side using secure environment configuration for the credentials.
Related
KINDE_CLIENT_IDKINDE_DOMAINKINDE_ISSUER_URLKINDE_WF_M2M_CLIENT_SECRETApplication details