2

I'm checking out Alchemy's tutorial https://docs.alchemy.com/alchemy/tutorials/hello-world-smart-contract/part-4, and it seems that they (and also every repo I have seen on the internet) store the alchemy API key in a .env in a react-app. My question is whether this API key is private to users. It appears to be public because you can store it in the frontend. But if this is the case, what is preventing you from exploiting other protocol's alchemy server? Thanks.

Improve this question

2 Answers 2

Reset to default
1

It should be kept private. Sometimes developers simply forget it public.

The reason it's not the end of the world is that it's so simple to revoke it, and even abusing it doesn't do much harm to anyone. Service providers (such as Alchemy) have various limits on the requests anyway.

So you shouldn't store it anywhere public.

Improve this answer
3
  • 1
    I agree you want to store them privately, even in those git repos they delete the true env variables. My question is the mere act of storing api keys on the client side seems to suggest the api key is not a private secret (like a password). Is this the case? If it's truely a secret then developers should store them in a backend. This backend will be communicating with the blockchain. However, no one can ensure this backend is not intentionally malicious hence violating the idea of decentralization.
    – user3799934
    Mar 17, 2022 at 20:38
  • 99% of the cases the frontend is centralized anyway, so it doesn't matter much if the backend is also centralized. Developers are just lazy and/or don't know what they're doing.
    – Lauri Peltonen
    Mar 18, 2022 at 6:22
  • @LauriPeltonen that's not the point. Frontend is bundled code on the browser. Even if its minified, the api key is still exposed.
    – alex067
    Sep 5 at 15:39
0

I don't know about 10 months ago, but now it looks like you can make your API key public.

  1. Protecting your API Keys
    There might be instances where you want to embed your API key somewhere public, like frontend-only applications.
    https://docs.alchemy.com/docs/best-practices-when-using-alchemy#7-protecting-your-api-keys

Don't forget to set the restriction for the key.

you can setup an allowlist within your Alchemy dashboard, specifying what domains, contract addresses, wallet addresses, or IP addresses are able to send requests.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.