Keeping credentials out of the code in .NET apps that talk to Dataverse

The temptation

In a personal app it is easy to leave the Dataverse client secret or an API key in an appsettings.json… until the repository goes public.

How I handle it in JTS Project

• On Windows, credentials are stored in Windows Credential Manager through a dedicated settings service.
• On Android (.NET MAUI), in SecureStorage, backed by the system keystore.
• On first run, the app asks for the tenant, client id, secret and environment URL from a settings screen.

Result

The repository can be public without worry: there are no secrets in code or configuration, and every device keeps its own, encrypted.