I have an API key for a service, and I've heard that putting it directly in frontend code is unsafe because users can inspect the app with browser developer tools and potentially misuse the key. Is there a secure way to use this key from a frontend without building a backend? I'm not very familiar with backend development yet.
2 Answers
It depends on the kind of key. If the key must remain private and you don’t want users making requests with it, you need to keep it on a server. Your frontend can call your backend, and the backend adds the secret key before contacting the external API.
Some services provide keys specifically intended for public clients, such as certain map APIs. Those keys should still be restricted by domain, enabled APIs, usage limits, and billing quotas. For a normal secret API key, use a backend or an API gateway you control to proxy the requests and prevent users from seeing the key.
Even a public map key can potentially be abused if it isn’t restricted. Someone could copy it and generate requests that increase your bill, so domain restrictions and quotas are still important.