I want to build a simple Next.js route that handles payments. In that route's handler I'm commentating with a third-party service via fetch to process a payment. One of the headers is a token (a secure token that should not be visible to anyone). I'm keeping the token in a string variable inside the route handler and using it in the fetch call.
My question is, is this safe? Is the API folder exposed to the front-end like everything else?
Everything added into the api folder will never reach the client side, however is recommended and considered as a good practice to save your sensitive data in .env file
API folder is not exposed on frontend you can safely store the token it will not be visible on frontend
once you add code on you /api folder it will be on server side unless you expose your token through res.send/res.json() or show the source code to other people then they will see your token. if you want you could add your token in environment variables
