I'm checking out Alchemy's tutorial https://docs.alchemy.com/alchemy/tutorials/hello-world-smart-contract/part-4, and it seems that they (and also every repo I have seen on the internet) store the alchemy API key in a .env in a react-app. My question is whether this API key is private to users. It appears to be public because you can store it in the frontend. But if this is the case, what is preventing you from exploiting other protocol's alchemy server? Thanks.
It should be kept private. Sometimes developers simply forget it public.
The reason it's not the end of the world is that it's so simple to revoke it, and even abusing it doesn't do much harm to anyone. Service providers (such as Alchemy) have various limits on the requests anyway.
So you shouldn't store it anywhere public.
I don't know about 10 months ago, but now it looks like you can make your API key public.
- Protecting your API Keys
There might be instances where you want to embed your API key somewhere public, like frontend-only applications.
Don't forget to set the restriction for the key.
you can setup an allowlist within your Alchemy dashboard, specifying what domains, contract addresses, wallet addresses, or IP addresses are able to send requests.