This one decodes a Dropbox encoded API key obtained here: https://dl-web.dropbox.com/spa/pjlfdak1tmznswp/api_keys.js/public/index.html It was written after studying dropbox-js/src/prod.coffee.

dropbox_api_key_decode.py

from base64 import b64encode, b64decode


def decode_key(key):
    key, secret = key.split('|')
    key = b64decode(key)
    key = [ord(x) for x in key]
    secret = b64decode(secret)

    s = range(256)
    y = 0
    for x in xrange(256):
        y = (y + s[len(key)] + key[x % len(key)]) % 256
        s[x], s[y] = s[y], s[x]

    x = y = 0
    result = []
    for z in range(len(secret)):
        x = (x + 1) % 256
        y = (y + s[x]) % 256
        s[x], s[y] = s[y], s[x]
        k = s[(s[x] + s[y]) % 256]
        result.append(chr((k ^ ord(secret[z])) % 256))

    key = ''.join([chr(a) for a in key])
    return '|'.join([b64encode(key), b64encode(''.join(result))])

Hello,

thanks a lot. This gist helped me (I think).
Anyway, i don't understand the security benefit. Putting conceal keys in the app and decode they before using. Everybody who want to have the keys can this also.