Is it any safer than pasting your auth tokens into a standalone application like Postman? That can just as easily send that information somewhere else, but now you can't press F12, get a network tab, and look at outgoing requests.
You actually can press CTRL+SHIFT+i to open dev tools in Postman. It is just electron after all. Also even if it were some other UI toolkit you could view the network requests via Fiddler/Wireshark/etc.
FYI, only requests made with the XHR/Fetch APIs in Electron apps show up in the console. Insomnia (I am the maintainer) uses libcurl to send requests, which do not appear in the console. The NodeJS http/https APIs also do not.
Everyone: don't use existing
please make new, unique keys for services like this. Time-box and revoke!
Can you please elaborate on what you mean by time-boxing and how you achieve it? I'm assuming it means to assign a time scope to a key and then revoke it's access outside of that time period. This would require access to the API authentication methods, correct? Otherwise, for API's that you don't have backend access to (e.g., GitHub API) you should just generate a token for testing and manually delete it when you are done?
They mean to assign an expiration date to your tokens. Then when you're done testing, still revoke the token, even if you haven't reached the expiration date.
This is exactly what I meant, thank you.
How does that stop the operator from watching the logs, and stealing all my data?