Secret handling

Device keys

• device_secret_key: Keep only in secure device storage and your server; used to sign requests.
• Do not embed in Mini Program bundles, front-end code, or public repositories.

WeChat credentials

• AppSecret, EncodingAESKey, WeChat push Token: server only.
• access_token: Refresh and cache on the server; do not send to devices or the Mini Program.

TiRTC connection credentials

• Bearer token for TiRtcWhipConnect: short-lived; obtained by the business server from tirtc-server-api.