title: Safely access secret keys in NodeJS CLI tool
body: <p>I have a NodeJS terminal utility that integrates with the Spotify API. The basic flow is:</p>
  
  <ul>
  <li>user launches cli tool in terminal</li>
  <li>CLI tool opens browser and completes oAuth 2.0 flow</li>
  <li>app stores access_token and refresh_token on user's filesystem.</li>
  <li>app uses credentials to get artwork for currently playing song and display it in the terminal</li>
  </ul>
  
  <p>I have the actual app working, but currently it relies on a Spotify API <code>clientId</code> and <code>clientKey</code>, and Spotify docs recommend keeping that <code>clientKey</code> a secret.</p>
  
  <p>Obviously I don't want each user to have to register their open app on spotify to use the utility.</p>
  
  <p>Is there a secure way to store my <code>clientKey</code> that would allow a user to just </p>
  
  <p><code>npm install &lt;utility&gt;</code> </p>
  
  <p>and then run?</p>