Most dapps require an instance of web3 provider in the browser. It seems that it is often achieved by directly connecting to Infura or Alchemy node URL (for example, in WalletConnect docs: https://docs.walletconnect.org/quick-start/dapps/web3-provider).

Infura and Alchemy charge for the node usage, so it seems a bit insecure to just embed node URL directly in the webapp code - anybody can extract the url (with the key) from the code and then use it for his own projects (or just make the dapp owner suffer by raking up huge fees for node usage).

Am I misunderstanding something? What is the common approach for dealing with this situation?

1 Answer 1


To start with, sometimes a separate provider is not needed at all. If you expect users to have a browser wallet (such as Metamask), that wallet has its own connection already, and you can simply utilize that for at least reading blockchain data.

If you don't expect (all) users to have (or enable) a browser wallet and/or wish to use a separate background provider, then the common approach is to use the provider in a way which is not exposed to the user, so that the user does not get to see the used provider key/secret. Typically this happens so that the website itself does not utilize the provider directly, but sends a request to backend which uses the provider - the provider queries sent by the backend are not visible to the frontend.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.