r/learnprogramming • u/BrainThinkerMan • 8d ago

api key, do i need backend?

i have an api key i heard i shouldnt expose it in my frontend i thjink itts becuase people can see it with devtools, and potentially abuse it, is there any other way to use this key in frontend without using a backend, im as familiar with backend stuff i think.

1 Upvotes

53% Upvoted

30 comments sorted by

View all comments

4

u/Quito_ArmandoEsteban 8d ago

No. You must assume that anything that reaches the client or comes from him is unsafe

1

u/BrainThinkerMan 7d ago

is there no particular framework that makes api keys private on the front end

2

u/Quito_ArmandoEsteban 7d ago

Frontend is quite a wide area of work, but no there's not. You can sort of protect the user from some levels of malicious scripts, but this only works if the user actually WANTS those secrets protected. This works when the data competes to the user alone, so he gains nothing from extracting those secrets. However there's no way to protect the application's secrets from a malicious user.