S3 + DevPay for a user application, do I hardcode my ProductToken?

subject says all, the REST api docs seem to make me think I do (and i开发者_JAVA百科f I dont my code doesnt work)

Do: -hard code ProductToken -ask user for authorization key

DoNot: -hard code (or use) access key ID -hard code (or use) secret access key

keep in mind this is for an application that uses devpay, not a website

thanks!

Either hardcode it or store it in an encrypted DB or XML file, as for Secret Key and Key ID, it is better to not hard code your own keys maybe as mentioned above store them in an encrypted file somewhere in your app and once you get the user Keys successfully delete the file that has your own keys or replace your keys with the new user credentials as you wont be needing your keys once the customer has successfully activated your product.

sure its always better to hide the ProductToken from the user rather than asking the user to input it manually because once your Product token goes public people can easily access your buckets and do whatever changes they like and you'll probably lose control of your data flow.