Hey everyone! I'm a developer with some experience in Azure/.NET, but I'm new to hosting my own apps and managing costs. I'm building a straightforward web app that simply makes API calls using one API key. Since users won't authenticate, I have to find a secure way to store this key.
I initially thought about using Azure Key Vault, but that's not free. I also noticed that the free version of Azure Static Web Apps limits my options, especially since I can't use Managed Identities or Key Vault references unless I upgrade to a paid plan, which is around $12 CAD a month - quite steep for a simple project!
Here's my setup so far:
1. I am deploying the app via Azure Static Web Apps, from a GitHub repo (not sure if private or public yet).
2. I'm using the free version of Azure API Management for basic rate throttling, but I'm not expecting much traffic.
3. Implementing simple HTTP caching since it's a free API, and I'm not worried about meaningful downtime.
Now, concerning the API key storage, I've got a few ideas but I'm unsure how safe they are:
- Hard-coding the key in the source code, but that sounds risky.
- Switching to Azure App Service, but I think that would be overkill for what I need.
- Storing it in a free database sounds complex because I'd need to handle the database credentials too.
I'd love any suggestions or insights on a cheap and effective way to securely store this API key without incurring extra costs. Thanks in advance!
1 Answer
You might want to consider using an environment file to store your API key. For example, if you’re deploying with Azure DevOps, you can keep it in the pipeline library and pull it into the build stage. Hardcoding is a big no-no for security—definitely avoid that! Also, did you know you can set up a CI/CD process with GitHub Actions to keep your secrets safe? That way, you wouldn’t need to expose your key in the front end.
I’m not too familiar with GitHub Actions, but I found that they can work well for CI/CD too! Just do it for your builds, and you can manage secrets without needing to go the Azure DevOps route for this small project.