title: How to: securely store secret tokens when publishing iOS App (Nativescript)
body: <p>My Nativescript app has some secret api tokens. I want to publish the app to the iOS app store. What do I need to do to keep the tokens secret when I publish the app?</p>
  
  <p>I see a discussion <a href="https://discourse.nativescript.org/t/best-practice-for-secrets-like-using-environmental-variables/6997/22" rel="nofollow noreferrer">here</a> about storing secrets using webpack environmental variables. I am new to webpack, but it seems like this is the best way to do it.</p>
  
  <p>Following that discussion, I am able put my tokens into the webpack bundle (instead of hardcoding it), like this:</p>
  
  <pre><code>$ tns run ios --bundle --env.uglify --env.aot --env.secret_token="yaySecret"
  </code></pre>
  
  <p>But does this keep "yaySecret" secret? I don't see this addressed anywhere in NS docs or online. </p>
  
  <p>I assume this bundle command creates a bundle, and then this bundle becomes part of what Apple publishes. But then isn't Apple able to view "yaySecret"? </p>