How to store and protect the private keys on the client side.
Is there any way to protect the API Key in JavaScript?.
I cannot just put it there in plain text as it can then be used by others who see the code. So would there be an implementation where the API remains secret?
How to protect API keys in PWA (Progressive Web Application)
Viewed 478
1 Answers
How to store and protect the private keys on the client side.
You can't.
Anything you send the client, the client has access to. Don't presume otherwise. No amount of encryption or anything will change this.
I cannot just put it there in plain text as it can then be used by others who see the code.
They don't even have to see your code. Monitoring the HTTP requests is enough to get your API keys in many cases.
So would there be an implementation where the API remains secret?
The API key should be attached to the user somehow. If they login, you assign a key specifically to them, for that specific session.
Related